{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/undertow-io/undertow","packageName":"undertow","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThanOrEqual":"2.3.14.Final","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"io.quarkus.http/quarkus-http-core","product":"Red Hat build of Quarkus 3.8.6.redhat","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"5.2.4.redhat-00001","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"io.undertow/undertow-core","product":"Red Hat JBoss Enterprise Application Platform","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.33.SP1-redhat-00001","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"eap7-undertow","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.2.33-1.SP1_redhat_00001.1.el8eap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"eap7-undertow","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.2.33-1.SP1_redhat_00001.1.el9eap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"eap7-undertow","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.2.33-1.SP1_redhat_00001.1.el7eap","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat JBoss Enterprise Application Platform 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"OpenShift Serverless","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat build of Apache Camel 4 for Quarkus 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat build of Apache Camel for Spring Boot 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat build of Apache Camel - HawtIO 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat build of Apicurio Registry 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat Build of Keycloak","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat build of OptaPlanner 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-undertow","product":"Red Hat build of Quarkus","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat Data Grid 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat Fuse 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat Integration Camel K 1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat Integration Camel Quarkus 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"undertow","product":"Red Hat JBoss Data Grid 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"undertow","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"undertow","product":"Red Hat JBoss Fuse Service Works 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat Process Automation 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"Red Hat Single Sign-On 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"undertow","product":"streams for Apache Kafka","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2024-3653","cwes":["CWE-401"],"description":"A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.","epss":{"date":"2026-11-06","percentile":0.7939,"score":0.01866},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793973553284,"publishedAt":1720473680899,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:4392"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:5143"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:5144"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:5145"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:5147"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2024:6437"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-3653"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274437"},{"source":"ADP: CVE","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2024:4392"},{"source":"ADP: CVE","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2024-3653"},{"source":"ADP: CVE","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274437"},{"source":"ADP: CVE","tags":[],"url":"https://security.netapp.com/advisory/ntap-20240828-0002/"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Setting the maxAge configuration is sufficient to prevent the behavior of this vulnerability being explored."}],"revision":"60cec5710e6d845a536b22b0c9642bb15273c5815fcb1d1b81f633234cf2c1a3","sources":[{"modifiedAt":1793973553284,"name":"CNA: redhat","retrievedAt":1793974161634,"url":"https://www.cve.org/CVERecord?id=CVE-2024-3653"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793977729157,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-3653"}],"ssvc":{"assessedAt":1736458533839,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Undertow: learningpushhandler can lead to remote memory dos attacks","updatedAt":1793977729157}