Search for packages
| purl | pkg:rpm/redhat/eap8-undertow@2.3.14-2.SP2_redhat_00001.1?arch=el9eap |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-xme8-usmd-vqg3
Aliases: CVE-2024-7885 GHSA-9623-mqmm-5rcf |
Undertow vulnerable to Race Condition A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments. | There are no reported fixed by versions. |
|
VCID-z6hm-cxw5-u3as
Aliases: CVE-2024-21634 GHSA-264p-99wq-f4j6 |
Ion Java StackOverflow vulnerability ### Impact A potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to: * Deserialize Ion text encoded data, or * Deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. Impacted versions: <1.10.5 ### Patches The patch is included in `ion-java` >= 1.10.5. ### Workarounds Do not load data which originated from an untrusted source or that could have been tampered with. **Only load data you trust.** ---- If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. [1] https://aws.amazon.com/security/vulnerability-reporting | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T13:50:30.184456+00:00 | RedHat Importer | Affected by | VCID-z6hm-cxw5-u3as | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21634.json | 38.0.0 |
| 2026-04-01T13:45:47.372665+00:00 | RedHat Importer | Affected by | VCID-xme8-usmd-vqg3 | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7885.json | 38.0.0 |