Skip to main content

Missing Release of Memory after Effective Lifetime

CVE-2024-3653

Medium
5.3/10

Summary

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the "maxAge" config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request. This issue affects the package io.undertow:undertow-core versions through 2.2.34.Final, and 2.3.0.Alpha1 through 2.3.15.Final.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-401 - Missing release of memory after effective lifetime (memory leak)

'Missing release of memory after effective lifetime (memory leak)' is a weakness that occurs when software doesn't effectively release allocated memory after it is used. If not addressed, this enables attackers to launch denial of service attacks (by crashing or hanging the program) or take advantage of other unexpected behavior resulting from low memory conditions.

References

Advisory Timeline

  • Published