Undertow: learningpushhandler can lead to remote memory dos attacks

Description

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Scores

EPSS (exploitation in 30 days)

1.9% · top 21% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-401: Missing Release of Memory after Effective Lifetime (opens in a new tab)All about CWE-401 and its CVEs

Affected products

• undertow

  • affected ≤ 2.3.14.Final

• Red Hat · Red Hat build of Quarkus 3.8.6.redhat

  • unaffected 5.2.4.redhat-00001 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform

  • unaffected 2.2.33.SP1-redhat-00001 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

  • unaffected 0:2.2.33-1.SP1_redhat_00001.1.el8eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

  • unaffected 0:2.2.33-1.SP1_redhat_00001.1.el9eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

  • unaffected 0:2.2.33-1.SP1_redhat_00001.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 8

  All versions: unaffected

• Red Hat · OpenShift Serverless

  All versions: affected

• Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3

  All versions: affected

• Red Hat · Red Hat build of Apache Camel for Spring Boot 4

  All versions: affected

• Red Hat · Red Hat build of Apache Camel - HawtIO 4

  All versions: unaffected

• Red Hat · Red Hat build of Apicurio Registry 2

  All versions: unaffected

• Red Hat · Red Hat Build of Keycloak

  All versions: unaffected

• Red Hat · Red Hat build of OptaPlanner 8

  All versions: affected

• Red Hat · Red Hat build of Quarkus

  All versions: unaffected

• Red Hat · Red Hat Data Grid 8

  All versions: affected

• Red Hat · Red Hat Fuse 7

  All versions: unknown

• Red Hat · Red Hat Integration Camel K 1

  All versions: affected

• Red Hat · Red Hat Integration Camel Quarkus 2

  All versions: affected

• Red Hat · Red Hat JBoss Data Grid 7

  All versions: unknown

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: unaffected

• Red Hat · Red Hat JBoss Fuse Service Works 6

  All versions: unknown

• Red Hat · Red Hat Process Automation 7

  All versions: unknown

• Red Hat · Red Hat Single Sign-On 7

  All versions: affected

• Red Hat · streams for Apache Kafka

  All versions: affected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenio.undertow:undertow-coreGHSA-ch7q-gpff-h9hp (opens in a new tab)

What to do

Workaround: Setting the maxAge configuration is sufficient to prevent the behavior of this vulnerability being explored.

References (9)

• RHSA-2024:4392 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:5143 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:5144 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:5145 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:5147 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:6437 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/security/cve/CVE-2024-3653 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
• RHBZ#2274437 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred
• https://security.netapp.com/advisory/ntap-20240828-0002/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-ch7q-gpff-h9hp (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-3653](https://trackcve.app/badge/CVE-2024-3653.svg)](https://trackcve.app/cve/CVE-2024-3653)

Record last updated 7 Nov 2026, 11:32 UTC.