CVE-2024-4109

CVE-2024-4109

[REJECTED CVE] A vulnerability has been identified in the Undertow package where the readHpackString method may incorrectly reuse an HTTP request header value from a previous stream for a new request on the same HTTP/2 connection due to improper handling of the stringBuilder field. While this typically results in an error and connection termination, an attacker could potentially exploit this flaw to leak sensitive information between requests within the same connection.

GHSA-22c5-cpvr-cfvq

Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse