CVE-2022-2053

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation without Limits8 documents7 sources
Severity
7.5HIGH
EPSS
0.3%
top 46.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat UndertowRedhat Jboss Fuse
Timeline
PublishedAug 5
Latest updateJan 15

Description

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶NVDredhat/undertow< 2.2.19+1
▶Mavenio.undertow:undertow-core2.3.0.Alpha1 — 2.3.0.Alpha2+1
▶Debianundertow< 2.2.18-1
▶CVEListV5undertowFixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2

🔴Vulnerability Details

4
GHSA
Undertow vulnerable to Dos via Large AJP request↗2022-08-06
▶
OSV
Undertow vulnerable to Dos via Large AJP request↗2022-08-06
▶
OSV
CVE-2022-2053: When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementati↗2022-08-05
▶
CVEList
CVE-2022-2053: When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementati↗2022-08-05
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (Undertow) — CVE-2022-2053↗2023-01-15
▶
Red Hat
undertow: Large AJP request may cause DoS↗2022-06-14
▶
Debian
CVE-2022-2053: undertow - When a POST request comes through AJP and the request exceeds the max-post-size ...↗2022
▶