Skip to content
Fencer Vulns
high 7.5

CVE-2024-6162 json

Undertow: url-encoded request path information can be broken on ajp-listener

published 2024-06-20 2 y ago modified 2026-06-17 4 mo ago also GHSA-9442-gm4v-r222 , EUVD-2024-1991

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

Patch / fix

  • maven io.undertow:undertow-core 2.2.33.Final, 2.3.14.Final
  • undertow Debian 14 2.3.18-1

debian advisories DEBIAN-CVE-2024-6162

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-6162 updated cvss 7.5

undertow: url-encoded request path information can be broken on ajp-listener

  • Red Hat build of Apache Camel for Spring Boot 3 undertow undertow Red Hat Fuse 7 undertow undertow Red Hat Integration Camel K 1 undertow undertow Red Hat JBoss Data Grid 7 undertow undertow
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack undertow undertow
    affected: workaround, no fix available
  • Red Hat Process Automation 7 undertow undertow Red Hat Single Sign-On 7 undertow undertow
    affected: workaround, no fix planned “Will not fix”
  • Red Hat EAP 8.0.1
    fixed: vendor fix RHSA-2024:1194
  • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
    fixed: vendor fix RHSA-2024:4884
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
    fixed: vendor fix RHSA-2024:4386
  • Red Hat build of Apache Camel - HawtIO 4 undertow undertow Red Hat Build of Keycloak undertow undertow Red Hat Data Grid 8 undertow undertow Red Hat JBoss Enterprise Application Platform 7 undertow undertow Red Hat JBoss Enterprise Application Platform 8 undertow undertow
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.70% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.undertow:undertow-core
>=2.3.0.Alpha1, <2.3.14.Final
<2.2.33.Final
2.3.14.Final
2.2.33.Final

Affected products

  • Red Hat EAP 8.0.1
  • Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-488 Exposure of Data Element to Wrong Session
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.