Log in Start free

Vulnerability · Published Jun 20, 2024 · Assigned by redhat

CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listener

High 7.5

In plain English

A high-severity security flaw in undertow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.7%top 22.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14undertow2.3.18-1DEBIAN-CVE-2024-6162
Mavenio.undertow:undertow-core2.3.14.FinalGHSA-9442-gm4v-r222
Mavenio.undertow:undertow-core2.2.33.FinalGHSA-9442-gm4v-r222
Ubuntu:25.10undertowno fix listedUBUNTU-CVE-2024-6162
Ubuntu:26.04:LTSundertowno fix listedUBUNTU-CVE-2024-6162
Ubuntu:26.10undertowno fix listedUBUNTU-CVE-2024-6162

Affected products (as reported)

VendorProductVersions
undertow 0 – before 2.2.33.Final2.3.0.Alpha1 – before 2.3.14
Red Hat EAP 8.0.1 see references
Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references
Red Hat Red Hat build of Apache Camel for Spring Boot 3 see references
Red Hat Red Hat build of Apache Camel - HawtIO 4 see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat Integration Camel K 1 see references
Red Hat Red Hat JBoss Data Grid 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references
Red Hat Red Hat Process Automation 7 see references
Red Hat Red Hat Single Sign-On 7 see references

Weakness: CWE-488 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References