dbcve.org
Active Iq Unified ManagerApplication · Netapp

CVE-2024-1635

HIGH · 7.5 CVSS v3.1 Published 2024-02-19
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
84/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

In Undertow servers supporting wildfly-http-client protocol, WriteTimeoutStreamSinkConduit leaks connections during HTTP upgrade to remoting when RemotingConnection is closed prematurely. The outer connection layer is unaware of the innermost Undertow conduit when closing, preventing WriteTimeoutStreamSinkConduit from being notified of the closed connection. This causes the timeout task (and its dependency tree) to leak into the XNIO WorkerThread, leading to memory and file descriptor exhaustion.

MitigationUpgrade Undertow to the patched version containing the fix, or disable wildfly-http-client protocol if not required, and implement connection limit controls at the network level to mitigate DoS impact.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Active Iq Unified ManagerApplication
Affected:all versions
FuseApplication
Affected:= 1.0
Integration Camel For Spring BootFramework / library
Affected:all versions
Jboss Enterprise Application PlatformApplication
Affected:= 7.4
Openshift Container PlatformApplication
Affected:= 4.11= 4.12
Openshift Container Platform For LinuxoneApplication
Affected:= 4.9= 4.10
Openshift Container Platform For PowerApplication
Affected:= 4.9= 4.10
Single Sign OnApplication
Affected:all versions= 7.6

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify if Undertow-based server is in use
    Check running Java processes for JBoss, WildFly, or Undertow components. Review application dependencies (pom.xml, lib folder) for undertow-core or jboss-undertow-core artifacts.
    Affected if Undertow server is running and wildfly-http-client protocol is enabled
  2. Confirm wildfly-http-client protocol is enabled
    Review Undertow subsystem configuration (standalone.xml, domain.xml) or client configuration files for 'http-remoting' or 'wildfly-http-client' protocol handler definitions. Check if the application uses HTTP upgrade for remoting.
    Affected if wildfly-http-client protocol is configured and used for HTTP upgrade connections
  3. Check Undertow version for patch status
    Locate the undertow-core JAR file in the deployment and check its version. Compare against known patched versions. For Red Hat products, check the errata or package version for the Undertow security update.
    Affected if Undertow version is unpatched and wildfly-http-client protocol is in use
  4. Monitor for connection leak symptoms
    Observe JVM heap usage and open file descriptor count over time during active HTTP upgrade remoting traffic. Use jstack or thread dumps to look for accumulation of WriteTimeout tasks in XNIO worker threads.
    Affected if Memory grows and file descriptors increase without release during normal operation with remoting connections
  5. Review network listener configuration
    Examine the undertow subsystem's <http-listener> or <https-listener> elements in configuration files. Check if HTTP upgrade is enabled and remoting connectors are exposed.
    Affected if HTTP upgrade to remoting is enabled on any public-facing or internal listener

A user is affected if they run an Undertow-based server with wildfly-http-client protocol enabled for HTTP upgrade to remoting, and the Undertow version is unpatched.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade Undertow to the patched version containing the fix, or disable wildfly-http-client protocol if not required, and implement connection limit controls at the network level to mitigate DoS impact.

Fix this in Active Iq Unified Manager Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA2.0 h
20.0 hours of engineering $3,500
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-1635 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-1635 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data