Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2336

CVE-2024-1635 At Http upgrade to remoting, WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener

XMLWordPrintable

      When the remoting server receives the EOF and closes the connection (see here) during an http upgrade operation, the WriteTimeoutStreamSinkConduit channel will be unaware the connection was closed and its timeout expiration handle will be kept active for a while and associated with the WorkerThread. As a result, the whole tree of channels for that connection will not be garbage collected until that task is executed, causing a temporary memory leak.
      This bug was uncovered as part of the investigation for WFLY-18700 and it is related to the stack trace shown in XNIO-427.

            ropalka Richard Opalka
            flaviarnn Flavia Rainone
            Alessio Soldano, Bartosz Baranowski, Brad Maxwell, Darran Lofthouse, Flavia Rainone, Ingo Weiss, Jan Kašík, Jason Lee, Lin Gao, Masafumi Miura, Paul Ferraro, Radoslav Husar, Richard Achmatowicz, Richard Opalka, Stefano Maestri, Tomas Hofman, Tom Jenkinson, Tommaso Bagassi
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: