Race Condition Affecting io.undertow:undertow-core package, versions [,2.2.36.Final) [2.3.0.Alpha1,2.3.17.Final)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-IOUNDERTOW-7707751
- published 18 Aug 2024
- disclosed 7 Aug 2024
- credit Unknown
Introduced: 7 Aug 2024
CVE-2024-7885 Open this link in a new tabHow to fix?
Upgrade io.undertow:undertow-core to version 2.2.36.Final, 2.3.17.Final or higher.
Overview
io.undertow:undertow-core is a Java web server based on non-blocking IO.
Affected versions of this package are vulnerable to Race Condition due to the reuse of the StringBuilder instance in the ProxyProtocolReadListener across multiple requests. An attacker can access data from previous requests or responses by exploiting the shared usage of the StringBuilder.
This vulnerability primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.