CVE-2023-5379
Undertow: ajp request closes connection exceeding maxrequestsize
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Undertow: ajp request closes connection exceeding maxrequestsize
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Record
CVE-2023-5379- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-770
- Updated
- 2026-11-05
EUVDEUVD-2023-57695
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Record
EUVD-2023-57695- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-q462-4hrv-w27r
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size...
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Record
GHSA-q462-4hrv-w27r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Record
CVE-2023-5379- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-05
OSV
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Record
CVE-2023-5379- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-5379
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Record
DEBIAN-CVE-2023-5379- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2024-2353
undertow security update
Java web server using non-blocking IO
Security Fix(es):
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.(CVE-2021-3690)
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).(CVE-2023-5379)
- Record
OESA-2024-2353- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2025:9582
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
- Record
RHSA-2025:9582- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2025:9583
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update
- Record
RHSA-2025:9583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-5379
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
- Record
UBUNTU-CVE-2023-5379- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
- redhat undertow
- redhat jboss enterprise application platform
- redhat single sign-on
- red hat build of quarkus
- red hat data grid 8
- red hat decision manager 7
- red hat fuse 7
- red hat jboss data grid 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 7.1 eus for rhel 7
- red hat jboss enterprise application platform 7.3 eus for rhel 7
- red hat jboss fuse 6
Affected packages
| Package | Affected | Fixed |
|---|---|---|
undertowDebian:14 |
before 2.3.18-1, plus listed versions 1.3.11-11.3.16-11.3.19-11.3.21-11.3.23-1 Show 45 moreShow less1.3.4-11.3.5-11.3.7-11.4.0-11.4.1-11.4.18-11.4.20-11.4.21-11.4.21-21.4.22-11.4.23-11.4.23-21.4.23-31.4.25-11.4.25-21.4.3-11.4.4-11.4.6-11.4.7-11.4.8-12.0.23-12.0.25-12.0.26-12.0.27-12.0.28-12.0.29-12.0.30-12.1.0-12.1.1-12.1.3-12.2.0-12.2.10-12.2.12-12.2.13-12.2.14-12.2.16-12.2.17-12.2.18-12.2.19-12.2.2-12.2.20-12.2.21-12.2.3-12.2.4-12.2.5-1 |
2.3.18-1 |
undertowopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.4.0-7.oe2203sp4 | 1.4.0-7.oe2203sp4 |
undertowopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.4.0-7.oe2203sp3 | 1.4.0-7.oe2203sp3 |
undertowopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.4.0-7.oe2003sp4 | 1.4.0-7.oe2003sp4 |
undertowopenEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.4.0-7.oe2203sp1 | 1.4.0-7.oe2203sp1 |
undertowopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 1.4.0-8.oe2403 | 1.4.0-8.oe2403 |
eap7-glassfish-elRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:3.0.1-4.b08_redhat_00005.1.ep7.el7 | 0:3.0.1-4.b08_redhat_00005.1.ep7.el7 |
eap7-glassfish-el-implRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:3.0.1-4.b08_redhat_00005.1.ep7.el7 | 0:3.0.1-4.b08_redhat_00005.1.ep7.el7 |
eap7-hibernateRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
eap7-hibernate-coreRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
Show 73 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap7-hibernate-entitymanagerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
eap7-hibernate-enversRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
eap7-hibernate-infinispanRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
eap7-hibernate-java8Red Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 | 0:5.1.17-3.Final_redhat_00004.1.ep7.el7 |
eap7-jackson-databindRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 | 0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 |
eap7-jboss-ejb-clientRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:4.0.12-1.Final_redhat_00002.1.ep7.el7 | 0:4.0.12-1.Final_redhat_00002.1.ep7.el7 |
eap7-nettyRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:4.1.63-2.Final_redhat_00003.1.ep7.el7 | 0:4.1.63-2.Final_redhat_00003.1.ep7.el7 |
eap7-netty-allRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:4.1.63-2.Final_redhat_00003.1.ep7.el7 | 0:4.1.63-2.Final_redhat_00003.1.ep7.el7 |
eap7-undertowRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.4.18-16.SP14_redhat_00001.1.ep7.el7 | 0:1.4.18-16.SP14_redhat_00001.1.ep7.el7 |
eap7-wildflyRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:7.1.11-4.GA_redhat_00002.1.ep7.el7 | 0:7.1.11-4.GA_redhat_00002.1.ep7.el7 |
eap7-wildfly-elytronRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.1.14-1.Final_redhat_00001.1.ep7.el7 | 0:1.1.14-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-http-clientRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-http-client-commonRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-http-ejb-clientRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-http-naming-clientRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-http-transaction-clientRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.21-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:7.1.11-4.GA_redhat_00002.1.ep7.el7 | 0:7.1.11-4.GA_redhat_00002.1.ep7.el7 |
eap7-wildfly-naming-clientRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.13-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.13-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-opensslRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.12-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.12-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-openssl-javaRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.12-1.Final_redhat_00001.1.ep7.el7 | 0:1.0.12-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-openssl-linuxRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.12-6.Final_redhat_00001.1.ep7.el7 | 0:1.0.12-6.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-openssl-linux-debuginfoRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 14 CVEs |
before 0:1.0.12-6.Final_redhat_00001.1.ep7.el7 | 0:1.0.12-6.Final_redhat_00001.1.ep7.el7 |
eap7-jackson-annotationsRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-3.redhat_00006.1.el7eap | 0:2.10.4-3.redhat_00006.1.el7eap |
eap7-jackson-coreRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-3.redhat_00006.1.el7eap | 0:2.10.4-3.redhat_00006.1.el7eap |
eap7-jackson-databindRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-5.redhat_00006.1.el7eap | 0:2.10.4-5.redhat_00006.1.el7eap |
eap7-jackson-datatype-jdk8Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-2.redhat_00006.1.el7eap | 0:2.10.4-2.redhat_00006.1.el7eap |
eap7-jackson-datatype-jsr310Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-2.redhat_00006.1.el7eap | 0:2.10.4-2.redhat_00006.1.el7eap |
eap7-jackson-jaxrs-baseRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-3.redhat_00006.1.el7eap | 0:2.10.4-3.redhat_00006.1.el7eap |
eap7-jackson-jaxrs-json-providerRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-3.redhat_00006.1.el7eap | 0:2.10.4-3.redhat_00006.1.el7eap |
eap7-jackson-jaxrs-providersRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-3.redhat_00006.1.el7eap | 0:2.10.4-3.redhat_00006.1.el7eap |
eap7-jackson-module-jaxb-annotationsRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-5.redhat_00006.1.el7eap | 0:2.10.4-5.redhat_00006.1.el7eap |
eap7-jackson-modules-baseRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-5.redhat_00006.1.el7eap | 0:2.10.4-5.redhat_00006.1.el7eap |
eap7-jackson-modules-java8Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.10.4-2.redhat_00006.1.el7eap | 0:2.10.4-2.redhat_00006.1.el7eap |
eap7-jboss-server-migrationRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-cliRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-coreRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-eap6.4Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-eap6.4-to-eap7.3Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-eap7.0Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-eap7.1Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-eap7.2Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-eap7.2-to-eap7.3Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-eap7.3-serverRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly10.0Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly10.1Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly11.0Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly12.0Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly13.0-serverRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly14.0-serverRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly15.0-serverRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly16.0-serverRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly17.0-serverRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly18.0-serverRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly8.2Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-jboss-server-migration-wildfly9.0Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.7.2-16.Final_redhat_00017.1.el7eap | 0:1.7.2-16.Final_redhat_00017.1.el7eap |
eap7-nettyRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:4.1.63-5.Final_redhat_00003.1.el7eap | 0:4.1.63-5.Final_redhat_00003.1.el7eap |
eap7-netty-allRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:4.1.63-5.Final_redhat_00003.1.el7eap | 0:4.1.63-5.Final_redhat_00003.1.el7eap |
eap7-undertowRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:2.0.41-4.SP5_redhat_00001.1.el7eap | 0:2.0.41-4.SP5_redhat_00001.1.el7eap |
eap7-wildflyRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:7.3.14-3.GA_redhat_00002.1.el7eap | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-elytronRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.10.17-1.Final_redhat_00001.1.el7eap | 0:1.10.17-1.Final_redhat_00001.1.el7eap |
eap7-wildfly-elytron-toolRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:1.10.17-1.Final_redhat_00001.1.el7eap | 0:1.10.17-1.Final_redhat_00001.1.el7eap |
eap7-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:7.3.14-3.GA_redhat_00002.1.el7eap | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-java-jdk8Red Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:7.3.14-3.GA_redhat_00002.1.el7eap | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-javadocsRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:7.3.14-3.GA_redhat_00002.1.el7eap | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform_eus:7.3::el7 From an advisory covering 14 CVEs |
before 0:7.3.14-3.GA_redhat_00002.1.el7eap | 0:7.3.14-3.GA_redhat_00002.1.el7eap |
undertowUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.4-11.3.5-11.3.7-11.3.11-11.3.16-11.3.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4.20-11.4.21-11.4.22-11.4.23-11.4.23-2build11.4.23-31.4.23-3ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.23-12.0.27-12.0.28-12.0.29-12.0.29-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.2.8-12.2.12-12.2.13-12.2.14-12.2.16-12.2.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.8-22.3.8-2ubuntu0.1~esm1 |
None known |
undertowUbuntu:25.10 |
All versions, plus listed versions 2.3.18-12.3.18-2 |
None known |
undertowUbuntu:26.10 |
All versions, plus listed versions 2.3.20-1ubuntu1 |
None known |
undertowUbuntu:26.04:LTS |
All versions, plus listed versions 2.3.18-22.3.20-12.3.20-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5379 is a high vulnerability (CVSS 7.5) in Redhat Undertow, published December 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in undertow 2.3.18-1.
References
access.redhat.com/errata/RHSA-2025:9582
bugzilla.redhat.com/show_bug.cgi?id=2242099
nvd.nist.gov/vuln/detail/CVE-2023-5379
Show 100 moreShow less
github.com/advisories/GHSA-q462-4hrv-w27r
security-tracker.debian.org/tracker/CVE-2023-5379
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2353
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
issues.redhat.com/browse/JBEAP-29413
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9582.json
cve.org/CVERecord?id=CVE-2020-10740
securitylab.github.com/advisories/GHSL-2020-021-jakarta-el
ubuntu.com/security/CVE-2023-5379
Left out here: 3 versions. The JSON record has them.