Skip to content
fr Sign in
7.5 High

CVE-2024-6162 A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on…

Description

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

Affected products and versions

Product Affected versions Fixed in
EAP 8.0.1 Versions not published
Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat build of Apache Camel for Spring Boot 3 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Integration Camel K 1 Versions not published
Show the 5 other branches
Product Affected versions Fixed in
Red Hat JBoss Data Grid 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Single Sign-On 7 Versions not published

References

Timeline

  1. Published
  2. Last modified
Track this CVE