The vulnerability CVE-2024-5971 in Undertow causes the chunked HTTP response to hang after the response body is flushed because the expected 0\r\n termination of the chunked response is not sent. This results in the client waiting indefinitely, leading to uncontrolled resource consumption on the server side and a denial of service condition. The issue specifically occurs in Java 17 TLSv1.3 NewSessionTicket scenarios. Red Hat advisories confirm the vulnerability affects Red Hat JBoss Enterprise Application Platform 8.0 and related Undertow components. Security updates have been issued to fix this problem.

The vulnerability leads to denial of service by causing the server to consume resources uncontrollably when handling chunked HTTP responses under Java 17 TLSv1.3. There is no impact on confidentiality or integrity, but availability is severely affected. No known exploits in the wild have been reported at this time.

Red Hat has released security updates addressing CVE-2024-5971 in Red Hat JBoss Enterprise Application Platform 8.0 and related Undertow components. Users should apply these official patches as per Red Hat's advisories (e.g., RHSA-2024:4392 and RHSA-2024:4884). Before applying updates, ensure all previous errata are applied. Patch status is confirmed as fixed in these advisories. No additional mitigation steps are indicated beyond applying the vendor-provided updates.