GHSA-ch7q-gpff-h9hp is a medium-severity (CVSS 5.3) CWE-401 vulnerability in io.undertow:undertow-core. A fix is available for io.undertow:undertow-core — see the affected versions and patch details below.
Undertow Missing Release of Memory after Effective Lifetime vulnerability
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-ch7q-gpff-h9hp.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-ch7q-gpff-h9hp plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
io.undertow:undertow-core☕io.undertow:undertow-coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | io.undertow:undertow-core | ≥ 2.3.0.Alpha1&&< 2.3.15.Final | 2.3.15.Finalio.undertow:undertow-core:2.3.15.Final |
| ☕Maven | io.undertow:undertow-core | all versions | 2.2.34.Finalio.undertow:undertow-core:2.2.34.Final |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.undertow:undertow-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update io.undertow:undertow-core to 2.3.15.Final or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-ch7q-gpff-h9hp is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-ch7q-gpff-h9hp can be triaged on real exposure rather than presence alone.
Tailored to GHSA-ch7q-gpff-h9hp. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat rates this as a Low impact vulnerability since the attacker needs to perform HTTP requests and the server must have incomplete configuration settings.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat build of Quarkus 3.8.6.redhat | io.quarkus.http/quarkus-http-core:5.2.4.redhat-00001 | RHSA-2024:6437 |
| Red Hat JBoss Enterprise Application Platform | io.undertow/undertow-core:2.2.33.SP1-redhat-00001 | RHSA-2024:5147 |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | eap7-undertow-0:2.2.33-1.SP1_redhat_00001.1.el8eap | RHSA-2024:5144 |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | eap7-undertow-0:2.2.33-1.SP1_redhat_00001.1.el9eap | RHSA-2024:5145 |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | eap7-undertow-0:2.2.33-1.SP1_redhat_00001.1.el7eap | RHSA-2024:5143 |
| Red Hat JBoss Enterprise Application Platform 8 | undertow | RHSA-2024:4392 |
Frequently Asked Questions
Is GHSA-ch7q-gpff-h9hp in your dependencies?
O3 Security finds GHSA-ch7q-gpff-h9hp across Maven dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.