Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jaDdxLWdwZmYtaDlocM4AA9on

Undertow Missing Release of Memory after Effective Lifetime vulnerability

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Permalink: https://github.com/advisories/GHSA-ch7q-gpff-h9hp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jaDdxLWdwZmYtaDlocM4AA9on
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: 24 days ago


CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Identifiers: GHSA-ch7q-gpff-h9hp, CVE-2024-3653
References: Blast Radius: 19.7

Affected Packages

maven:io.undertow:undertow-core
Dependent packages: 912
Dependent repositories: 5,259
Downloads:
Affected Version Ranges: <= 2.3.14.Final
No known fixed version
All affected versions: 2.3.1-0.Final, 2.3.1-1.Final, 2.3.1-2.Final, 2.3.1-3.Final, 2.3.1-4.Final