A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
CVSS
No CVSS.
References
Configurations
No configuration.
History
23 Sep 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
12 Aug 2024, 13:38
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Jul 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jul 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-08 22:15
Updated : 2024-09-23 20:15
NVD link : CVE-2024-3653
Mitre link : CVE-2024-3653
JSON object : View
Products Affected
No product.
CWE
CWE-401
Missing Release of Memory after Effective Lifetime