CVE-2024-3653 is a vulnerability in the Undertow web server component used by Red Hat JBoss Enterprise Application Platform. The flaw occurs when the learning-push handler is enabled without configuring the maxAge parameter, which defaults to -1, resulting in a condition where memory is not released after its effective lifetime. This can be exploited remotely by an attacker sending standard HTTP requests, leading to a denial of service via memory exhaustion. The vulnerability is not present if the maxAge configuration is overwritten from its default. Red Hat has issued security advisories and patches for affected versions of JBoss Enterprise Application Platform 7.4 and 8.0 to remediate this issue.

The vulnerability allows a remote attacker to cause a denial of service by exhausting server memory due to the learning-push handler not releasing memory properly when maxAge is set to its default of -1. There is no impact on confidentiality or integrity. The attack requires no privileges and no user interaction beyond sending normal HTTP requests to the server with the vulnerable handler enabled and unconfigured. This can degrade or disrupt service availability.

Red Hat has released official security updates for Red Hat JBoss Enterprise Application Platform versions 7.4 and 8.0 that address this vulnerability. Applying these updates will remediate the issue. Alternatively, disabling the learning-push handler or explicitly configuring the maxAge parameter to a non-default value will prevent exploitation. Users should follow Red Hat's guidance and apply the relevant errata updates as detailed in the vendor advisories. Patch status is confirmed as fixed in these updates.