CVE-2024-7885A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests.
Updated under an hour ago ()
Does this affect you?
It affects redhat build_of_apache_camel_-_hawtio and 8 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-362
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
redhat build_of_apache_camel_-_hawtio redhat:build_of_apache_camel_-_hawtio | all versions | NVD |
redhat build_of_apache_camel_for_spring_boot redhat:build_of_apache_camel_for_spring_boot | all versions | NVD |
redhat build_of_keycloak redhat:build_of_keycloak | all versions | NVD |
redhat data_grid redhat:data_grid | 8.0.0 | NVD |
redhat integration_camel_k redhat:integration_camel_k | all versions | NVD |
redhat jboss_enterprise_application_platform redhat:jboss_enterprise_application_platform | 7.0.0; 8.0.0 | NVD |
redhat jboss_fuse redhat:jboss_fuse | 7.0.0 | NVD |
redhat process_automation redhat:process_automation | 7.0 | NVD |
redhat single_sign-on redhat:single_sign-on | 7.0 | NVD |
References
- https://access.redhat.com/errata/RHSA-2024:11023
- https://access.redhat.com/errata/RHSA-2024:6508
- https://access.redhat.com/errata/RHSA-2024:6883
- https://access.redhat.com/errata/RHSA-2024:7441
- https://access.redhat.com/errata/RHSA-2024:7442
- https://access.redhat.com/errata/RHSA-2024:7735
- https://access.redhat.com/errata/RHSA-2024:7736
- https://access.redhat.com/errata/RHSA-2024:8080
- https://access.redhat.com/errata/RHSA-2025:16667
- https://access.redhat.com/errata/RHSA-2026:0743
- https://access.redhat.com/security/cve/CVE-2024-7885vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2305290issue-tracking, vendor-advisory
- https://security.netapp.com/advisory/ntap-20241011-0004/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.