CVE-2024-3653

What it actually does

Misconfigured learning-push handler with default maxAge of -1 permits unbounded resource consumption when the handler is enabled and reachable via HTTP.

Why it matters to the business

Organizations running the affected Undertow package may experience service degradation or brief outages if the optional handler is turned on without an explicit maxAge setting; the issue has low public exploit likelihood and no known ransomware usage.

How an attack unfolds

An attacker sends ordinary HTTP requests to a server where the learning-push handler is explicitly enabled and left at the default maxAge of -1, triggering the vulnerable code path that leads to availability impact.

How to fix it

Upgrade undertow to version 2.3.18-1 or later on Debian 13; if the handler must remain enabled, explicitly set a positive maxAge value in its configuration.

How to confirm the fix worked

Verify the installed package version is at least 2.3.18-1 and inspect configuration files to confirm the learning-push handler is either disabled or has maxAge set to a value other than -1.

Typical attack path

1. Confirm the learning-push handler is enabled in Undertow configuration
2. Send repeated standard HTTP requests to the server
3. Trigger resource exhaustion due to unbounded maxAge handling

How to detect it

Review server configuration files for the learning-push handler stanza and search access logs for unusual volumes of requests to endpoints that would invoke push learning.

What your security team should do

• Audit Undertow configurations for any enabled learning-push handlers and disable them unless explicitly required
• Apply the 2.3.18-1 package update across all Debian 13 systems
• Add package version checks to routine vulnerability scanning