CVE-2024-3653: Undertow: learningpushhandler can lead to remote memory dos attacks
A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
Other sources
A vulnerability was found in Undertow. This vulnerability requires enabling the learning-push handler in the server's config (it is disabled by default), leave the maxAge config in the handler unconfigured. The default is -1, so it makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3653?
CVE-2024-3653 is rated as a high severity vulnerability due to the risk of unauthorized access stemming from improperly configured settings.
How do I fix CVE-2024-3653?
To mitigate CVE-2024-3653, ensure that the learning-push handler is configured properly and set the maxAge parameter to a secure value instead of the default -1.
What software versions are affected by CVE-2024-3653?
CVE-2024-3653 affects io.undertow:undertow-core versions prior to 2.2.34.Final and between 2.3.0.Alpha1 and 2.3.15.Final.
What type of attack can CVE-2024-3653 enable?
CVE-2024-3653 can potentially enable unauthorized data access or manipulation attacks if the handler is misconfigured.
Is CVE-2024-3653 actively being exploited?
Current reports do not indicate that CVE-2024-3653 is being actively exploited in the wild, but it is strongly advised to apply fixes to prevent potential risks.