Undertow: Infinite loop in SslConduit during close

🗓️ 04 May 2023 15:59:31Reported by RedHatType

Undertow has an infinite loop in the secure socket layer conduit during close due to handshake status, causing denial of service.

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting Watson Knowledge Catalog for IBM Cloud Pak for Data	5 Jul 202318:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.3	18 Jun 202414:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not vulnerable to multiple vulnerabilities in Undertow	14 Jul 202321:09	–	ibm
ATTACKERKB	CVE-2023-1108	14 Sep 202315:15	–	attackerkb
BDU FSTEC	The vulnerability of the Undertow web server, related to executing a loop with an unavailable exit condition, allows attackers to cause a service failure.	12 Apr 202300:00	–	bdu_fstec
Circl	CVE-2023-1108	14 Sep 202318:24	–	circl
CNNVD	Red Hat JBoss Enterprise Application Platform 安全漏洞	10 Mar 202300:00	–	cnnvd
CVE	CVE-2023-1108	14 Sep 202314:48	–	cve
Cvelist	CVE-2023-1108 Undertow: infinite loop in sslconduit during close	14 Sep 202314:48	–	cvelist
Debian CVE	CVE-2023-1108	14 Sep 202314:48	–	debiancve

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-1108
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/advisories/GHSA-m4mm-pg93-fv78
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-1108
cve	www.cve.org/CVERecord

28 Jun 2026 12:39Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.01771

SSVC