{"action":"Upgrade io.undertow:undertow-core to 2.2.36.Final (2.2.x) or 2.3.17.Final (2.3.x) or later.","affected":[{"fixed":"2.2.36.Final","introduced":"0"},{"fixed":"2.3.17.Final","introduced":"2.3.0.Alpha1"}],"component":"io.undertow:undertow-core","cve_ids":["CVE-2024-7885"],"ecosystem":"Maven","epss":0.02644,"exploited":false,"fixed_versions":["2.2.36.Final","2.3.17.Final"],"ghsa_id":"GHSA-9623-mqmm-5rcf","id":"tcs_01M5N8P7ZP6KHC0GHFH1MNS318","modified_at":"2026-02-03T03:06:13.966827Z","published_at":"2024-08-21T15:30:54Z","references":["https://osv.dev/vulnerability/GHSA-9623-mqmm-5rcf","https://nvd.nist.gov/vuln/detail/CVE-2024-7885","https://github.com/undertow-io/undertow/commit/ce5182c37376982ef0abee34fce0d8c0aab0fab8","https://github.com/undertow-io/undertow/commit/80c125e09068ac52ed0a9acde266ef12f8ed7ae1","https://security.netapp.com/advisory/ntap-20241011-0004","https://github.com/undertow-io/undertow/blob/182e4ca1543c52f438b0244c930dca3d8b6e68e3/core/src/main/java/io/undertow/server/protocol/proxy/ProxyProtocolReadListener.java","https://github.com/undertow-io/undertow","https://bugzilla.redhat.com/show_bug.cgi?id=2305290","https://access.redhat.com/security/cve/CVE-2024-7885","https://access.redhat.com/errata/RHSA-2026:0743","https://access.redhat.com/errata/RHSA-2025:16667","https://access.redhat.com/errata/RHSA-2024:8080","https://access.redhat.com/errata/RHSA-2024:7736","https://access.redhat.com/errata/RHSA-2024:7735","https://access.redhat.com/errata/RHSA-2024:7442","https://access.redhat.com/errata/RHSA-2024:7441","https://access.redhat.com/errata/RHSA-2024:6883","https://access.redhat.com/errata/RHSA-2024:6508","https://access.redhat.com/errata/RHSA-2024:11023"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9623-mqmm-5rcf","url":"https://osv.dev/vulnerability/GHSA-9623-mqmm-5rcf"}],"summary":"Undertow vulnerable to Race Condition"}