The vulnerability CVE-2024-7885 affects Undertow's ProxyProtocolReadListener component, which reuses a single StringBuilder instance when parsing multiple requests on the same HTTP connection via the parseProxyProtocolV1 method. This improper synchronization leads to a race condition where different requests may share the same StringBuilder, causing potential data leakage between requests or responses. The flaw primarily causes errors and connection termination but can also result in unintended exposure of data from previous requests. Multiple Red Hat advisories confirm the issue and provide security updates to remediate it.

The vulnerability can cause information leakage between HTTP requests processed on the same connection, potentially exposing data from previous requests or responses. It also leads to errors and connection termination, impacting service availability. No known exploits in the wild have been reported. The CVSS 3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and an impact primarily on availability.

Red Hat has released security updates that address this vulnerability. Users should apply the relevant errata and updates from Red Hat to remediate the issue. Before applying these updates, ensure all previously released errata relevant to your system are applied. Refer to Red Hat's official advisories and update instructions at https://access.redhat.com/articles/11258. Patch status is confirmed as available via these vendor advisories.