{"action":"Upgrade io.undertow:undertow-core to 2.2.34.Final (2.2.x) or 2.3.15.Final (2.3.x) or later.","affected":[{"fixed":"2.3.15.Final","introduced":"2.3.0.Alpha1"},{"fixed":"2.2.34.Final","introduced":"0"}],"component":"io.undertow:undertow-core","cve_ids":["CVE-2024-3653"],"ecosystem":"Maven","epss":0.01866,"exploited":false,"fixed_versions":["2.3.15.Final","2.2.34.Final"],"ghsa_id":"GHSA-ch7q-gpff-h9hp","id":"tcs_01M5N8SEK4RBRKGEPR2W6X6EEZ","modified_at":"2024-11-04T22:35:25.764123Z","published_at":"2024-07-09T00:31:40Z","references":["https://osv.dev/vulnerability/GHSA-ch7q-gpff-h9hp","https://nvd.nist.gov/vuln/detail/CVE-2024-3653","https://github.com/undertow-io/undertow/pull/1639","https://github.com/undertow-io/undertow/pull/1640","https://github.com/undertow-io/undertow/pull/1641","https://access.redhat.com/errata/RHSA-2024:4392","https://access.redhat.com/errata/RHSA-2024:5143","https://access.redhat.com/errata/RHSA-2024:5144","https://access.redhat.com/errata/RHSA-2024:5145","https://access.redhat.com/errata/RHSA-2024:5147","https://access.redhat.com/errata/RHSA-2024:6437","https://access.redhat.com/security/cve/CVE-2024-3653","https://bugzilla.redhat.com/show_bug.cgi?id=2274437","https://github.com/undertow-io/undertow","https://issues.redhat.com/browse/UNDERTOW-2382"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-ch7q-gpff-h9hp","url":"https://osv.dev/vulnerability/GHSA-ch7q-gpff-h9hp"}],"summary":"Undertow Missing Release of Memory after Effective Lifetime vulnerability"}