CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listener

Description

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

Timeline

Scores

EPSS (exploitation in 30 days)

1.7% · top 22% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• undertow

  • affected < 2.2.33.Final
  • affected 2.3.0.Alpha1 – < 2.3.14

• Red Hat · EAP 8.0.1

  All versions: unaffected

• Red Hat · Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2

  All versions: unaffected

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: unaffected

• Red Hat · Red Hat build of Apache Camel for Spring Boot 3

  All versions: affected

• Red Hat · Red Hat build of Apache Camel - HawtIO 4

  All versions: unaffected

• Red Hat · Red Hat Build of Keycloak

  All versions: unaffected

• Red Hat · Red Hat Data Grid 8

  All versions: unaffected

• Red Hat · Red Hat Fuse 7

  All versions: affected

• Red Hat · Red Hat Integration Camel K 1

  All versions: affected

• Red Hat · Red Hat JBoss Data Grid 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: unaffected

• Red Hat · Red Hat JBoss Enterprise Application Platform 8

  All versions: unaffected

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: affected

• Red Hat · Red Hat Process Automation 7

  All versions: affected

• Red Hat · Red Hat Single Sign-On 7

  All versions: affected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenio.undertow:undertow-coreGHSA-9442-gm4v-r222 (opens in a new tab)

What to do

Workaround: To mitigate this issue, you can either switch to a different listener like the http-listener, or adjust the AJP listener configuration. By setting decode-url="false" on the AJP listener and configuring a separate URL decoding filter, you can prevent the path decoding errors. This adjustment ensures that each request is processed correctly without interference from concurrent requests.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2024-1991 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-9442-gm4v-r222 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-6162](https://cveledger.app/badge/CVE-2024-6162.svg)](https://cveledger.app/cve/CVE-2024-6162)

Record last updated 25 Feb 2026, 20:31 UTC.