CVE-2024-1635
published 2024-02-19CVE-2024-1635: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
4.57%
90.6th percentile
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.
At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | undertow | < undertow 2.3.18-1 (forky) | undertow 2.3.18-1 (forky) |
| redhat | fuse | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform_for_linuxone | — | — |
| redhat | openshift_container_platform_for_linuxone | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | single_sign-on | — | — |
| redhat | undertow | >= 0 < 2.3.18-1 | 2.3.18-1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Undertow) — CVE-2024-1635
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2024-1635 [HIGH] Oracle Oracle Communications Risk Matrix: Install/Upgrade (Undertow) — CVE-2024-1635
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Undertow) vulnerability
CVE: CVE-2024-1635
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Debian
CVE-2024-1635: undertow - A vulnerability was found in Undertow. This vulnerability impacts a server that ...
vendor_debian·2024·CVSS 7.5
CVE-2024-1635 [HIGH] CVE-2024-1635: undertow - A vulnerability was found in Undertow. This vulnerability impacts a server that ...
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hen
Red Hat
undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol
vendor_redhat·2023-10-27·CVSS 7.5
CVE-2024-1635 [HIGH] CWE-400 undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol
undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.
At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unawa
GHSA
Undertow Uncontrolled Resource Consumption Vulnerability
ghsa·2024-02-20
CVE-2024-1635 [HIGH] CWE-400 Undertow Uncontrolled Resource Consumption Vulnerability
Undertow Uncontrolled Resource Consumption Vulnerability
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.
At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing
OSV
Undertow Uncontrolled Resource Consumption Vulnerability
osv·2024-02-20
CVE-2024-1635 [HIGH] Undertow Uncontrolled Resource Consumption Vulnerability
Undertow Uncontrolled Resource Consumption Vulnerability
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.
At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing
OSV
CVE-2024-1635: A vulnerability was found in Undertow
osv·2024-02-19·CVSS 7.5
CVE-2024-1635 [HIGH] CVE-2024-1635: A vulnerability was found in Undertow
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hen
Suricata
ET WEB_SERVER Possible IIS Integer Overflow DoS (CVE-2015-1635)
suricata·2015-04-15·CVSS 9.8
CVE-2015-1635 [CRITICAL] ET WEB_SERVER Possible IIS Integer Overflow DoS (CVE-2015-1635)
ET WEB_SERVER Possible IIS Integer Overflow DoS (CVE-2015-1635)
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible IIS Integer Overflow DoS (CVE-2015-1635)"; flow:established,to_server; http.request_header; header_lowercase; content:"range|3a 20|"; startswith; content:"18446744073709551615"; fast_pattern; distance:0; reference:cve,2015-1635; classtype:web-application-attack; sid:2020912; rev:6; metadata:created_at 2015_04_15, cve CVE_2015_1635, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_04_21;)
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2024:1674https://access.redhat.com/errata/RHSA-2024:1675https://access.redhat.com/errata/RHSA-2024:1676https://access.redhat.com/errata/RHSA-2024:1677https://access.redhat.com/errata/RHSA-2024:1860https://access.redhat.com/errata/RHSA-2024:1861https://access.redhat.com/errata/RHSA-2024:1862https://access.redhat.com/errata/RHSA-2024:1864https://access.redhat.com/errata/RHSA-2024:1866https://access.redhat.com/errata/RHSA-2024:3354https://access.redhat.com/errata/RHSA-2024:4884https://access.redhat.com/errata/RHSA-2025:4226https://access.redhat.com/errata/RHSA-2025:9583https://access.redhat.com/security/cve/CVE-2024-1635https://bugzilla.redhat.com/show_bug.cgi?id=2264928https://access.redhat.com/errata/RHSA-2024:1674https://access.redhat.com/errata/RHSA-2024:1675https://access.redhat.com/errata/RHSA-2024:1676https://access.redhat.com/errata/RHSA-2024:1677https://access.redhat.com/errata/RHSA-2024:1860https://access.redhat.com/errata/RHSA-2024:1861https://access.redhat.com/errata/RHSA-2024:1862https://access.redhat.com/errata/RHSA-2024:1864https://access.redhat.com/errata/RHSA-2024:1866https://access.redhat.com/security/cve/CVE-2024-1635https://bugzilla.redhat.com/show_bug.cgi?id=2264928https://security.netapp.com/advisory/ntap-20240322-0007/
2024-02-19
Published