Skip to content
Fencer Vulns
high 7.5

CVE-2023-5379 json

Undertow: ajp request closes connection exceeding maxrequestsize

published 2023-12-12 2 y ago modified 2026-11-05 4 d ago also EUVD-2023-57695

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).

Patch / fix

  • Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 0:1.0.12-1.Final_redhat_00001.1.ep7.el7, 0:1.0.12-6.Final_redhat_00001.1.ep7.el7, 0:1.0.13-1.Final_redhat_00001.1.ep7.el7, 0:1.0.21-1.Final_redhat_00001.1.ep7.el7, 0:1.1.14-1.Final_redhat_00001.1.ep7.el7, 0:1.4.18-16.SP14_redhat_00001.1.ep7.el7, 0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7, 0:3.0.1-4.b08_redhat_00005.1.ep7.el7, 0:4.0.12-1.Final_redhat_00002.1.ep7.el7, 0:4.1.63-2.Final_redhat_00003.1.ep7.el7, 0:5.1.17-3.Final_redhat_00004.1.ep7.el7, 0:7.1.11-4.GA_redhat_00002.1.ep7.el7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 0:1.7.2-16.Final_redhat_00017.1.el7eap, 0:1.10.17-1.Final_redhat_00001.1.el7eap, 0:2.0.41-4.SP5_redhat_00001.1.el7eap, 0:2.10.4-2.redhat_00006.1.el7eap, 0:2.10.4-3.redhat_00006.1.el7eap, 0:2.10.4-5.redhat_00006.1.el7eap, 0:4.1.63-5.Final_redhat_00003.1.el7eap, 0:7.3.14-3.GA_redhat_00002.1.el7eap
  • undertow Debian 14 2.3.18-1

debian advisories DEBIAN-CVE-2023-5379

  • eap7-netty jboss enterprise application platform eus 7.3 4.1.63-5.Final_redhat_00003.1.el7eap
  • eap7-wildfly jboss enterprise application platform eus 7.3 7.3.14-3.GA_redhat_00002.1.el7eap
  • eap7-undertow jboss enterprise application platform eus 7.3 2.0.41-4.SP5_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform eus 7.3 4.1.63-5.Final_redhat_00003.1.el7eap
  • eap7-jackson-core jboss enterprise application platform eus 7.3 2.10.4-3.redhat_00006.1.el7eap
  • eap7-wildfly-elytron jboss enterprise application platform eus 7.3 1.10.17-1.Final_redhat_00001.1.el7eap
  • eap7-wildfly-modules jboss enterprise application platform eus 7.3 7.3.14-3.GA_redhat_00002.1.el7eap
  • eap7-jackson-databind jboss enterprise application platform eus 7.3 2.10.4-5.redhat_00006.1.el7eap

red hat advisories RHSA-2025:9583RHSA-2025:9582

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5379 updated cvss 7.5

undertow: AJP Request closes connection exceeding maxRequestSize

  • Red Hat Decision Manager 7 undertow undertow Red Hat Fuse 7 undertow undertow Red Hat JBoss Data Grid 7 undertow undertow
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform 7 undertow undertow
    affected: no fix available
  • Red Hat JBoss Fuse 6 undertow undertow Red Hat Process Automation 7 undertow undertow
    affected: no fix planned “Out of support scope”
  • Red Hat Single Sign-On 7 undertow undertow
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.11-4.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-2.Final_redhat_00003.1.ep7.el7, eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7, eap7-glassfish-el 3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-3.Final_redhat_00004.1.ep7.el7, eap7-netty-all 4.1.63-2.Final_redhat_00003.1.ep7.el7, +19 more
    fixed: vendor fix RHSA-2025:9582
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.14-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-5.Final_redhat_00003.1.el7eap, eap7-jackson-core 2.10.4-3.redhat_00006.1.el7eap, eap7-undertow 2.0.41-4.SP5_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-5.Final_redhat_00003.1.el7eap, eap7-jackson-databind 2.10.4-5.redhat_00006.1.el7eap, +37 more
    fixed: vendor fix RHSA-2025:9583
  • Red Hat build of Quarkus quarkus-undertow Red Hat Data Grid 8 undertow undertow Red Hat support for Spring Boot undertow undertow
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Decision Manager 7
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Fuse 6
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat Red Hat support for Spring Boot

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.