CVE-2023-1108

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2023
Source publication: Sep 14, 2023
Source updated: Aug 2, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Undertow: infinite loop in sslconduit during close

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

io.undertow:undertow-core

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: Unknown
Package: io.undertow:undertow-core
Package collection: https://github.com/undertow-io/undertow

io.undertow:undertow-core · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.3.5	`unaffected`	Unavailable	Unavailable	Unavailable	None listed
2.2.24	`unaffected`	Unavailable	Unavailable	Unavailable	None listed

EAP 7.4.10 release

Vendor: Red Hat
Product: EAP 7.4.10 release
Platforms: Unknown
Default status: unaffected
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat Fuse 7.12

Vendor: Red Hat
Product: Red Hat Fuse 7.12
Platforms: Unknown
Default status: unaffected
Package: undertow
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 7.1.0

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.1.0
Platforms: Unknown
Default status: unaffected
Package: undertow
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap7-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.2.22-1.SP3_redhat_00002.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.4.9-6.GA_redhat_00004.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap7-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.2.23-1.SP2_redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap7-undertow-jastow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.0.14-1.Final_redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
Platforms: Unknown
Default status: affected
Package: eap7-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.2.22-1.SP3_redhat_00002.1.el9eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.4.9-6.GA_redhat_00004.1.el9eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
Platforms: Unknown
Default status: affected
Package: eap7-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.2.23-1.SP2_redhat_00001.1.el9eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
Platforms: Unknown
Default status: affected
Package: eap7-undertow-jastow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.0.14-1.Final_redhat_00001.1.el9eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.2.22-1.SP3_redhat_00002.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.4.9-6.GA_redhat_00004.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.2.23-1.SP2_redhat_00001.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-undertow-jastow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.0.14-1.Final_redhat_00001.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7

Vendor: Red Hat
Product: Red Hat Single Sign-On 7
Platforms: Unknown
Default status: unaffected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Single Sign-On 7.6 for RHEL 7

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 7
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.8-1.redhat_00001.1.el7sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 8

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 8
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.8-1.redhat_00001.1.el8sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 9

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 9
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.8-1.redhat_00001.1.el9sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat support for Spring Boot 2.7.13

Vendor: Red Hat
Product: Red Hat support for Spring Boot 2.7.13
Platforms: Unknown
Default status: unaffected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rh-sso-7/sso76-openshift-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.6-24	`unaffected`	rpm	*	Unavailable	None listed

RHPAM 7.13.1 async

Vendor: Red Hat
Product: RHPAM 7.13.1 async
Platforms: Unknown
Default status: unaffected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Quarkus

Vendor: Red Hat
Product: Red Hat build of Quarkus
Platforms: Unknown
Default status: unaffected
Package: io.quarkus/quarkus-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Data Grid 8

Vendor: Red Hat
Product: Red Hat Data Grid 8
Platforms: Unknown
Default status: unaffected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Integration Camel K

Vendor: Red Hat
Product: Red Hat Integration Camel K
Platforms: Unknown
Default status: affected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Integration Camel Quarkus

Vendor: Red Hat
Product: Red Hat Integration Camel Quarkus
Platforms: Unknown
Default status: unaffected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Integration Service Registry

Vendor: Red Hat
Product: Red Hat Integration Service Registry
Platforms: Unknown
Default status: affected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Data Grid 7

Vendor: Red Hat
Product: Red Hat JBoss Data Grid 7
Platforms: Unknown
Default status: unknown
Package: undertow
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform Expansion Pack

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform Expansion Pack
Platforms: Unknown
Default status: affected
Package: undertow
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Fuse 6

Vendor: Red Hat
Product: Red Hat JBoss Fuse 6
Platforms: Unknown
Default status: unknown
Package: undertow
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat OpenStack Platform 13 (Queens)

Vendor: Red Hat
Product: Red Hat OpenStack Platform 13 (Queens)
Platforms: Unknown
Default status: affected
Package: undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.