CVE-2022-2053

Vulnerability

Overview

CVE-2022-2053 affects Undertow's AJP (Apache JServ Protocol) implementation. When a POST request exceeding the configured max-post-size (maxEntitySize) limit is received, the AjpServerRequestConduit closes the connection without sending any HTTP response to the client or the front-end proxy [1]. This behavior violates the expected protocol handshake, causing the proxy to interpret the backend worker (application server) as unavailable or in error state [2].

Attack

Scenario and Exploitation

An attacker can exploit this by sending a single oversized POST request to an Undertow server behind a load balancer. No authentication is required, as the check occurs before request processing [1]. The proxy will then mark the affected backend worker as down. In deployments using mod_cluster, the worker remains in error state until the next STATUS interval (up to 10 seconds), potentially leading to all workers being marked down and a "503 Service Unavailable" response [1]. In mod_proxy_balancer, the worker is avoided until the configured "retry" timeout passes, but due to the default forcerecovery=On setting, a full DoS is less likely. However, repeated attacks can still degrade performance and availability [1].

Impact

The primary impact is a denial of service (DoS) condition that temporarily prevents the backend from serving requests. The attack is low in complexity and requires no special network position beyond the ability to reach the proxy or load balancer [2]. While the window of unavailability is short (up to 10 seconds), a sustained attack can keep workers in a constant error state, effectively making the application unavailable [1].

Mitigation

Undertow has fixed this issue in versions 2.2.19.Final and 2.3.0.Alpha2 by properly handling the RequestTooBigException and closing the connection cleanly [3][4]. All users are strongly advised to upgrade to these or later versions. No workaround is mentioned in the public advisories, but limiting access to the AJP connector and monitoring for oversized requests can reduce risk [1].