Public vulnerability disclosure
CVE-2024-7885
Undertow: improper state management in proxy protocol parsing causes information leakage
publishedCWE-362
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
Technical severity7.5 highCVSS 3.1 · CNA: redhat
Published2024-08-21Source updated 2026-11-03
Collected2026-11-032 attributed sources
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
undertow
https://github.com/undertow-io/undertow |
≥ 0; < 2.2.36.Final (affected, custom) ≥ 2.3.0.Alpha1; < 2.3.17.Final (affected, custom) Other versions: unaffected |
CNA: redhat |
| HawtIO 4.0.0 for Red Hat build of Apache Camel 4 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat build of Apache Camel 3.20.7 for Spring Boot Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat build of Apache Camel 4.4.2 for Spring Boot Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform Red Hat io.undertow/undertow-core
https://access.redhat.com/downloads/content/package-browser/ |
≥ 2.2.33.SP2-redhat-00001; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7 Red Hat https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-apache-commons-beanutils
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.11.0-1.redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-hornetq
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.4.11-1.Final_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jboss-server-migration
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.7.2-19.Final_redhat_00020.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.41-5.SP6_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.3.15-5.GA_redhat_00003.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jackson-annotations
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.10.4-4.redhat_00008.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jackson-core
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.10.4-4.redhat_00008.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jackson-databind
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.10.4-6.redhat_00008.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jackson-jaxrs-providers
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.10.4-4.redhat_00008.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jackson-modules-base
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.10.4-6.redhat_00008.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jackson-modules-java8
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.10.4-3.redhat_00008.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-jboss-server-migration
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.7.2-20.Final_redhat_00021.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-netty
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.1.63-6.Final_redhat_00004.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.41-6.SP7_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.3.16-3.GA_redhat_00003.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.33-2.SP2_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.18-1.GA_redhat_00003.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.33-2.SP2_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.18-1.GA_redhat_00003.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.33-2.SP2_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.18-1.GA_redhat_00003.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8 Red Hat undertow-core
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-amazon-ion-java
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.11.9-2.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:800.3.1-2.GA_redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.14-2.SP2_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.3-13.GA_redhat_00007.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-amazon-ion-java
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.11.9-2.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:800.3.1-2.GA_redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.14-2.SP2_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.3-13.GA_redhat_00007.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Apache Camel for Spring Boot 3 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat build of Apache Camel - HawtIO 4 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Build of Keycloak Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat build of Quarkus Red Hat quarkus-undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Data Grid 8 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Fuse 7 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat Integration Camel K 1 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Data Grid 7 Red Hat undertow
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7 Red Hat undertow-core
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat undertow-core
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Process Automation 7 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Single Sign-On 7 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2024:11023CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6508CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6883CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:7441CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:7442CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:7735CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:7736CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:8080CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:16667CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:0743CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-7885CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2305290CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://security.netapp.com/advisory/ntap-20241011-0004/ADP: CVE
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.