CVE-2024-3653

Published: Jul 8, 2024

Modified: Nov 7, 2025

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Vendor	Product	Versions
Unknown	undertow	affected `0 - <= 2.3.14.Final`
Red Hat	Red Hat build of Quarkus 3.8.6.redhat	unaffected `5.2.4.redhat-00001 - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	unaffected `0:2.2.33-1.SP1_redhat_00001.1.el8eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9	unaffected `0:2.2.33-1.SP1_redhat_00001.1.el9eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	unaffected `0:2.2.33-1.SP1_redhat_00001.1.el7eap - < *`
Red Hat	Red Hat JBoss Enterprise Application Platform 8	All versions
Red Hat	OpenShift Serverless	All versions
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	All versions
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	All versions
Red Hat	Red Hat build of Apache Camel - HawtIO 4	All versions
Red Hat	Red Hat build of Apicurio Registry 2	All versions
Red Hat	Red Hat Build of Keycloak	All versions
Red Hat	Red Hat build of OptaPlanner 8	All versions
Red Hat	Red Hat build of Quarkus	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Fuse 7	All versions
Red Hat	Red Hat Integration Camel K 1	All versions
Red Hat	Red Hat Integration Camel Quarkus 2	All versions
Red Hat	Red Hat JBoss Data Grid 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat JBoss Fuse Service Works 6	All versions
Red Hat	Red Hat Process Automation 7	All versions
Red Hat	Red Hat Single Sign-On 7	All versions
Red Hat	streams for Apache Kafka	All versions