CVE-2024-3653

CVE-2024-3653 · Undertow: learningpushhandler can lead to remote memory dos attacks

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

CVSS 5.3 · Medium · EPSS 1.9% · Fix available

Published

2024-07-08T21:21:20.899Z

Updated

2026-09-08T23:07:27.845Z

Stack: system

Check your server →