CVE-2024-3653: Undertow Learning-Push Handler DOS Vulnerability

CVE-2024-3653 Overview

CVE-2024-3653 is a memory leak vulnerability [CWE-401] in Undertow, the high-performance web server used by JBoss EAP and WildFly. The flaw resides in the learning-push handler, which caches server push mappings learned from client requests. When the handler is enabled with the default maxAge value of -1, cached entries never expire. A remote unauthenticated attacker can send crafted HTTP requests to exhaust server memory over time, leading to denial of service.

Critical Impact

Remote unauthenticated attackers can trigger unbounded memory growth in Undertow instances running the learning-push handler with default configuration, degrading availability of Red Hat JBoss EAP, WildFly, and downstream products.

Affected Products

• Red Hat JBoss Enterprise Application Platform (multiple versions per RHSA-2024:4392, 5143, 5144, 5145, 5147, 6437)
• Red Hat build of Apache Camel and related middleware embedding Undertow
• NetApp products bundling Undertow (per NetApp advisory ntap-20240828-0002)

Discovery Timeline

• 2024-07-08 - CVE-2024-3653 published to the National Vulnerability Database
• 2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2024-3653

Vulnerability Analysis

Undertow's learning-push handler observes incoming requests and remembers resource associations so it can proactively push related assets on subsequent requests. Each learned entry is stored in an in-memory cache keyed by request path and referrer. The cache honors a maxAge configuration value that governs entry expiration.

When learning-push is enabled but maxAge is left at its default of -1, entries never expire. An attacker who can reach the server with normal HTTP requests can insert an unbounded number of unique entries into the cache. Repeated requests with varied URI paths cause continuous heap growth until the Java Virtual Machine (JVM) exhausts memory, producing service degradation or full denial of service.

Root Cause

The root cause is a missing resource release condition mapped to [CWE-401] Missing Release of Memory After Effective Lifetime. The handler treats -1 as an indefinite retention interval rather than rejecting the insecure default. Administrators enabling the feature without explicitly overriding maxAge inherit the vulnerable behavior.

Attack Vector

Exploitation requires only network reachability to the Undertow HTTP listener and no authentication or user interaction. An attacker issues repeated HTTP requests with distinct paths and referrer headers that the learning-push handler will cache. Because entries never age out, sustained low-rate traffic is sufficient to drive the JVM heap toward exhaustion. The attack does not compromise confidentiality or integrity; the impact is limited to availability.

See the Red Hat CVE Analysis CVE-2024-3653 and Red Hat Bug Report #2274437 for upstream technical details.

Detection Methods for CVE-2024-3653

Indicators of Compromise

• Sustained heap growth in JVM metrics for Undertow, JBoss EAP, or WildFly processes without a matching increase in legitimate traffic volume.
• Frequent full garbage collection cycles followed by OutOfMemoryError entries in server logs.
• HTTP access logs showing large volumes of requests with unique URI paths or referrer headers from a small set of source IPs.

Detection Strategies

• Inspect Undertow or WildFly configuration for an enabled learning-push handler with maxAge unset or set to -1.
• Correlate application performance monitoring (APM) heap metrics with HTTP request rate to identify memory growth uncoupled from workload.
• Enable JVM heap histograms or flight recordings and look for growing LearningPushHandler cache structures.

Monitoring Recommendations

• Alert on JVM old-generation heap utilization exceeding baseline thresholds over rolling windows.
• Track HTTP request cardinality per source IP to identify abnormal path or referrer diversity targeting push-enabled endpoints.
• Forward Undertow and JBoss EAP logs to a centralized analytics platform to correlate OutOfMemoryError events with upstream request patterns.

How to Mitigate CVE-2024-3653

Immediate Actions Required

• Apply the fixed Undertow packages shipped with the relevant Red Hat Security Advisories, including RHSA-2024:4392, RHSA-2024:5143, RHSA-2024:5144, RHSA-2024:5145, RHSA-2024:5147, and RHSA-2024:6437.
• Audit all Undertow, WildFly, and JBoss EAP deployments for learning-push handler usage and disable it where not required.
• Consult the NetApp Security Advisory ntap-20240828-0002 for NetApp product-specific remediation.

Patch Information

Red Hat has issued fixes across multiple product streams that address the memory leak in the learning-push handler. Administrators should map deployed versions to the corresponding RHSA errata and update to the patched Undertow release. Downstream vendors such as NetApp have published separate advisories tracking their integration of the fix.

Workarounds

• Disable the learning-push handler in the Undertow server configuration when HTTP/2 server push learning is not required.
• Explicitly configure a finite maxAge value on the learning-push handler to bound cache lifetime and prevent unbounded growth.
• Place a reverse proxy or Web Application Firewall (WAF) in front of Undertow to rate-limit requests with high path or referrer cardinality from a single source.

# Example: explicitly set a bounded maxAge on the learning-push handler in WildFly/JBoss EAP CLI
/subsystem=undertow/configuration=handler/learning-push=lp:write-attribute(name=max-age,value=600000)