Sign in Sign up
JA · EN · FR
SecPulse
Web Application
CVE-2024-5971 high CVSS 7.5

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not s...

Web Application

Summary

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource co...

Original description

The description as published by the source.

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.

Source: NIST National Vulnerability Database NVD

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

Undertowで、チャンク応答がフラッシュされた後にハングする脆弱性が発見されました。この問題は、Java 17 TLSv1.3シナリオでのみ発生します。この脆弱性により、サーバー側でのリソース消費が制御できなくなり、サービス拒否攻撃を受ける可能性があります。

❓ What is the problem

Undertowにおいて、チャンクされた応答がフラッシュ後にハングする脆弱性。

📍 Affected scope

Java 17 TLSv1.3使用時のUndertow。

🔥 Severity

この脆弱性により、サービス拒否攻撃が可能となる。

🔧 How to fix

Undertowのアップデートを待ち、最新のパッチを適用すること。

🛡️ Workaround

情報なし

🔍 Detection

Java 17 TLSv1.3を使用しているかを確認し、異常なリソース消費がないか監視する。

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details