CVE-2024-5971

What it actually does

The flaw prevents Undertow from emitting the required 0\r\n chunk termination after flushing a chunked response body under Java 17 TLSv1.3, leaving the connection open indefinitely and consuming server resources.

Why it matters to the business

Attackers can trigger repeated requests that exhaust server threads or connections, causing denial of service and degraded availability for applications using the affected Undertow version on Debian 13.

How an attack unfolds

An unauthenticated remote attacker sends HTTP requests that cause Undertow to generate a chunked response over TLSv1.3 on Java 17; the missing termination keeps the client waiting while the server holds the connection, allowing resource exhaustion through repeated triggering.

How to fix it

Upgrade Undertow on Debian 13 to version 2.3.18-1 or later; apply the package update and restart affected services.

How to confirm the fix worked

Confirm the installed package version is at least 2.3.18-1; reproduce a chunked response scenario under Java 17 TLSv1.3 and verify the 0\r\n terminator is present in the response.

Typical attack path

1. Identify a reachable endpoint served by vulnerable Undertow that returns chunked responses
2. Issue HTTP requests over TLSv1.3 on Java 17 to trigger the incomplete chunked encoding
3. Repeat the requests to accumulate hung connections and exhaust server resources

How to detect it

Review web server access and error logs for patterns of requests that trigger chunked responses without completion; correlate with high numbers of open connections or thread exhaustion on Java 17 TLSv1.3 deployments.

What your security team should do

• Apply the 2.3.18-1 package update immediately on all Debian 13 systems running Undertow
• Prioritize systems exposed to the internet or handling high request volumes
• Monitor for connection exhaustion patterns while the update is rolled out