CVE-2024-6162
Undertow: url-encoded request path information can be broken on ajp-listener
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7.5
Undertow: url-encoded request path information can be broken on ajp-listener
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
CVE-2024-6162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-488
- Updated
- 2026-11-02
EUVDEUVD-2024-1991
7.5
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
EUVD-2024-1991- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9442-gm4v-r222
8.7
Undertow's url-encoded request path information can be broken on ajp-listener
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
GHSA-9442-gm4v-r222- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-488
- Updated
- 2026-11-02
NVD
7.5
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
CVE-2024-6162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-488
- Updated
- 2026-11-02
OSV
7.5
Undertow: url-encoded request path information can be broken on ajp-listener
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
CVE-2024-6162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-488
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-6162
7.5
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
DEBIAN-CVE-2024-6162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-9442-gm4v-r222
8.7
Undertow's url-encoded request path information can be broken on ajp-listener
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
GHSA-9442-gm4v-r222- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-488
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-6162
7.5
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
- Record
UBUNTU-CVE-2024-6162- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1766016491 No score
TuxCare security update for io.undertow:undertow-core (4 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 4 CVEs. Fixed in 2.3.10.Final-tuxcare.1.
- Record
CLSA-2025-1766016491- Updated
- 2026-11-02
OSVCLSA-2026-1780966317 No score
TuxCare security update for io.undertow:undertow-core (4 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 4 CVEs. Fixed in 2.3.0.Final-tuxcare.1.
- Record
CLSA-2026-1780966317- Updated
- 2026-11-02
OSVCLSA-2026-1787137111 No score
TuxCare security update for io.undertow:undertow-core (6 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 6 CVEs. Fixed in 2.2.24.Final-tuxcare.1.
- Record
CLSA-2026-1787137111- Updated
- 2026-11-02
OSVCLSA-2026-1793853308 No score
TuxCare security update for io.undertow:undertow-core (6 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 6 CVEs. Fixed in 1.4.27.Final-tuxcare.3.
- Record
CLSA-2026-1793853308- Updated
- 2026-11-05
Affected products
- red hat eap 8.0.1
- red hat build of apache camel - hawtio 4
- red hat build of apache camel 4.4.1 for spring boot 3.2
- red hat build of apache camel for spring boot 3
- red hat build of keycloak
- red hat data grid 8
- red hat fuse 7
- red hat integration camel k 1
- red hat jboss data grid 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.undertow:undertow-coreMaven |
2.3.0.Alpha1 up to 2.3.14.Final | 2.3.14.Final |
io.undertow:undertow-coreMaven |
before 2.2.33.Final | 2.2.33.Final |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.3.10.Final up to 2.3.10.Final-tuxcare.1 | 2.3.10.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.3.0.Final up to 2.3.0.Final-tuxcare.1 | 2.3.0.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 6 CVEs |
2.2.24.Final up to 2.2.24.Final-tuxcare.1 | 2.2.24.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 6 CVEs |
1.4.27.Final up to 1.4.27.Final-tuxcare.3, plus listed versions 1.4.27.Final-tuxcare.11.4.27.Final-tuxcare.2 |
1.4.27.Final-tuxcare.3 |
undertowDebian:14 |
before 2.3.18-1, plus listed versions 1.3.11-11.3.16-11.3.19-11.3.21-11.3.23-1 Show 45 moreShow less1.3.4-11.3.5-11.3.7-11.4.0-11.4.1-11.4.18-11.4.20-11.4.21-11.4.21-21.4.22-11.4.23-11.4.23-21.4.23-31.4.25-11.4.25-21.4.3-11.4.4-11.4.6-11.4.7-11.4.8-12.0.23-12.0.25-12.0.26-12.0.27-12.0.28-12.0.29-12.0.30-12.1.0-12.1.1-12.1.3-12.2.0-12.2.10-12.2.12-12.2.13-12.2.14-12.2.16-12.2.17-12.2.18-12.2.19-12.2.2-12.2.20-12.2.21-12.2.3-12.2.4-12.2.5-1 |
2.3.18-1 |
io.undertow:undertow-coreMaven |
2.3.0.Alpha1 up to 2.3.14.Final, plus listed versions 2.3.0.Alpha22.3.0.Beta12.3.0.Final2.3.1.Final2.3.10.Final Show 11 moreShow less2.3.11.Final2.3.12.Final2.3.13.Final2.3.2.Final2.3.3.Final2.3.4.Final2.3.5.Final2.3.6.Final2.3.7.Final2.3.8.Final2.3.9.Final |
2.3.14.Final |
io.undertow:undertow-coreMaven |
before 2.2.33.Final, plus listed versions 1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13 Show 45 moreShow less1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha201.0.0.Alpha211.0.0.Alpha221.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta101.0.0.Beta111.0.0.Beta121.0.0.Beta131.0.0.Beta141.0.0.Beta151.0.0.Beta161.0.0.Beta171.0.0.Beta181.0.0.Beta191.0.0.Beta21.0.0.Beta201.0.0.Beta211.0.0.Beta221.0.0.Beta231.0.0.Beta241.0.0.Beta251.0.0.Beta261.0.0.Beta271.0.0.Beta281.0.0.Beta291.0.0.Beta31.0.0.Beta301.0.0.Beta311.0.0.Beta321.0.0.Beta331.0.0.Beta4 |
2.2.33.Final |
undertowUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.4-11.3.5-11.3.7-11.3.11-11.3.16-11.3.16-1ubuntu0.1~esm1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
undertowUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4.20-11.4.21-11.4.22-11.4.23-11.4.23-2build11.4.23-31.4.23-3ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.23-12.0.27-12.0.28-12.0.29-12.0.29-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.2.8-12.2.12-12.2.13-12.2.14-12.2.16-12.2.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.8-22.3.8-2ubuntu0.1~esm1 |
None known |
undertowUbuntu:25.10 |
All versions, plus listed versions 2.3.18-12.3.18-2 |
None known |
undertowUbuntu:26.10 |
All versions, plus listed versions 2.3.20-1ubuntu1 |
None known |
undertowUbuntu:26.04:LTS |
All versions, plus listed versions 2.3.18-22.3.20-12.3.20-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-6162 is a high vulnerability (CVSS 7.5) in Red Hat Eap 8.0.1, published June 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in io.undertow:undertow-core 2.3.14.Final.
References
access.redhat.com/errata/RHSA-2024:1194
access.redhat.com/errata/RHSA-2024:4386
access.redhat.com/errata/RHSA-2024:4884
access.redhat.com/security/cve/CVE-2024-6162
bugzilla.redhat.com/show_bug.cgi?id=2293069
issues.redhat.com/browse/JBEAP-26268
Show 16 moreShow less
security.netapp.com/advisory/ntap-20241129-0009
nvd.nist.gov/vuln/detail/CVE-2024-6162
github.com/undertow-io/undertow/pull/1612
github.com/undertow-io/undertow/commit/90f202ada89b6d9883beed0f1fe10c99d470d9a8
github.com/undertow-io/undertow/commit/a28ac53076e2fa532266d25e0c0b1a01d0e9d2cf
issues.redhat.com/browse/UNDERTOW-2334
github.com/undertow-io/undertow/releases/tag/2.2.33.Final
github.com/undertow-io/undertow/releases/tag/2.3.14.Final
github.com/advisories/GHSA-9442-gm4v-r222
access.redhat.com/downloads/content/package-browser
access.redhat.com/jbossnetwork/restricted/listSoftware.html
github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6162.json
github.com/undertow-io/undertow
security-tracker.debian.org/tracker/CVE-2024-6162
ubuntu.com/security/CVE-2024-6162
cve.org/CVERecord?id=CVE-2024-6162
Left out here: 254 versions. The JSON record has them.