AJP listener fails to start with UT000220 error after updating to JBoss EAP 7.4.25+ / 8.1 update 8+

Solution Verified - Updated

Environment

  • Red Hat JBoss Enterprise Application Platform (EAP)
    • 7.4.25+
    • 8.1 update 8+

Issue

  • After updating to JBoss EAP 7.4.25+ or 8.1 update 8+, Undertow AJP listeners fail to start with UT000220 errors like below:
ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service org.wildfly.undertow.listener.ajp: org.jboss.msc.service.StartException in service org.wildfly.undertow.listener.ajp: Failed to start service
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1731)
        at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1559)
        at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
        at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1363)
        at java.lang.Thread.run(Thread.java:750)
Caused by: java.lang.IllegalArgumentException: UT000220: The AJP listener is configured to require secret but the secret is either null or empty string. This combination is not allowed.
        at io.undertow.server.protocol.ajp.AjpOpenListener.createAjpRequestParser(AjpOpenListener.java:205)
        at io.undertow.server.protocol.ajp.AjpOpenListener.<init>(AjpOpenListener.java:114)
        at org.wildfly.extension.undertow.AjpListenerService.createOpenListener(AjpListenerService.java:60)
        at org.wildfly.extension.undertow.ListenerService.start(ListenerService.java:177)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1739)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1701)
        ... 6 more

ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([
    ("subsystem" => "undertow"),
    ("server" => "default-server"),
    ("ajp-listener" => "ajp")
]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.undertow.listener.ajp" => "Failed to start service
    Caused by: java.lang.IllegalArgumentException: UT000220: The AJP listener is configured to require secret but the secret is either null or empty string. This combination is not allowed."}}
  • JBoss EAP 7.4.23 got patched to 7.4.25 and not starting anymore.
2026-08-19 08:52:32,170 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-6) MSC000001: Failed to start service org.wildfly.undertow.listener.ajp: org.jboss.msc.service.StartException in service org.wildfly.undertow.listener.ajp:
Failed to start service
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1731)
        at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1559)
        at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
        at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1363)
        at java.lang.Thread.run(Thread.java:750)
Caused by: java.lang.IllegalArgumentException: UT000220: The AJP listener is configured to require secret but the secret is either null or empty string. This combination is not allowed.
        at io.undertow.server.protocol.ajp.AjpOpenListener.createAjpRequestParser(AjpOpenListener.java:205)
        at io.undertow.server.protocol.ajp.AjpOpenListener.<init>(AjpOpenListener.java:114)
        at org.wildfly.extension.undertow.AjpListenerService.createOpenListener(AjpListenerService.java:60)
        at org.wildfly.extension.undertow.ListenerService.start(ListenerService.java:177)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1739)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1701)
        ... 6 more

Resolution

Two new system properties are introduced in this This content is not included.CVE-2026-15554 fix, which can be used to avoid the error condition:

  • io.undertow.ajp.REQUIRE_AJP_SECRET (defaults to true) - controls if an AJP listener requires a secret to start successfully
  • io.undertow.ajp.AJP_SECRET (defaults to empty string) - the secret value to be used

To avoid the start up error after the This content is not included.CVE-2026-15554fix, one of the following can be pursued in order of preference:

  1. Remove the <ajp-listener> line from your undertow subsystem if AJP is not required and used. Users can remove the related AJP socket-binding line configuration, since it also is no longer used, but it would have no real impact either way if left and unused or removed.
  2. If AJP is currently used, consider switching to HTTP/HTTPS proxying so the <ajp-listener> can be removed. AJP is a legacy and not recommended protocol to be used nowadays as it was originally developed with no security in mind. So if looking for a truly secure alternative, migrating from AJP to HTTP(s) protocols would be preferred.
  3. If not migrating from AJP, set a secret through the added io.undertow.ajp.AJP_SECRET property. That can be set as a system property like -Dio.undertow.ajp.AJP_SECRET=secretValueadded in JVM options or per Add/remove/update system properties in JBoss EAP 8 / 7 / 6 via CLI/xml. An added secret needs to be set with a matching value on the AJP proxy side also. Note the secret is just a cleartext string sent across an unencrypted connection so it adds virtually no true security in the event that an attacker can view the transmitted data on the network and then easily see and reuse the secret themselves if having direct access to the AJP port.
  4. Or least preferred, revert to behavior like EAP 7.4.24/8.1 update 7 and earlier to allow an ajp-listener to start without a secret if you set the added io.undertow.ajp.REQUIRE_AJP_SECRET property to false.

Note that AJP pings will fail on 7.4.25 with an AJP_SECRET and this can be addressed per AJP pings and proxy attempts fail after updating to EAP 7.4.25. If continuing to use AJP, ensure it is operating in a trusted environment with proper firewall / proxy setups that ensure only trustworthy users are granted access to the AJP port.

Root Cause

  • The This content is not included.CVE-2026-15554 fix added in these updates now does not allow the AJP listener to start without a configured secret by design so this error is intended to prevent configurations that are likely lacking in security
SBR
Product(s)
Components
Category
Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.