CVE-2024-7885

What it actually does

ProxyProtocolReadListener reuses a single StringBuilder instance in parseProxyProtocolV1 across multiple requests on the same HTTP connection, allowing data from one request or response to be erroneously included in another or triggering connection termination.

Why it matters to the business

May expose portions of previous request or response data to other clients on persistent connections, creating privacy or compliance risks, while also causing connection drops that disrupt service availability.

How an attack unfolds

An attacker establishes a persistent HTTP connection and sends multiple proxy-protocol-v1 requests in sequence; because the StringBuilder is shared, data remnants from an earlier request may appear in a later response or cause the server to terminate the connection.

How to fix it

Upgrade Undertow to version 2.3.18-1 or newer on Debian 13; apply the corresponding fixed linux_kernel build dated 2021-08-05 or later on affected Android devices.

How to confirm the fix worked

Confirm the installed Undertow package version is at least 2.3.18-1; perform repeated proxy-protocol requests on a single connection and verify that StringBuilder contents are not reused across requests.

Typical attack path

1. Establish a persistent HTTP connection to an Undertow-based server using proxy protocol
2. Issue multiple rapid requests over the same connection
3. Inspect subsequent responses or error behavior for leakage of prior request data

How to detect it

Review server logs for repeated proxy-protocol parsing errors or abrupt connection closures; correlate response bodies across sessions on the same connection for unexpected data reuse.

What your security team should do

• Apply the listed fixed versions immediately due to the 781-day publication window and stable EPSS
• Disable proxy protocol on public interfaces until patched
• Monitor connection termination rates and response anomalies in proxy-protocol traffic