PatchTheCVECVE-2024-1635: A vulnerability was found in Undertow
CVE-2024-1635 is a high-severity flaw (CVSS 7.5) affecting active iq unified manager, active iq unified manager, active iq unified manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit
Why this priority
- High severity
- EPSS top 8%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 4.6% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-400 |
| Published | 2024-02-19 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-1635?
active iq unified manager: mitigate or apply the listed mitigation; active iq unified manager: mitigate or apply the listed mitigation; active iq unified manager: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2024-1635 being exploited?
CVE-2024-1635 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-1635 affect?
CVE-2024-1635 affects active iq unified manager, active iq unified manager, active iq unified manager. Severity is high (CVSS 7.5). A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connecti
How urgent is CVE-2024-1635?
Priority 59/100. High severity; EPSS top 8%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Spring Framework vulnerabilities · JBoss and WildFly vulnerabilities
Related CVEs
- CVE-2023-2828 HIGH 7.5 UPGRADE MITIGATE Every `named` instance configured to run as a recursive resolver maintains a cache database holding the respon
- CVE-2023-2911 HIGH 7.5 UPGRADE MITIGATE If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes
- CVE-2023-2829 HIGH 7.5 UPGRADE MITIGATE A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSS
- CVE-2023-27535 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can r
- CVE-2023-23915 MEDIUM 6.5 UPGRADE MITIGATE A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS