Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded (Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7)

CVE-2024-3884
HIGH 7.5

At a glance

Source
NVD
EPSS
EPSS 1.36 % · percentile 72 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Search on…

Description

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Weaknesses (CWE)

  • CWE-20 — Improper Input Validation

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCISA-ADP
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Advisories

European references

Affected products

ProductVersions
Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7unaffected 0:1.4.18-19.SP17_redhat_00001.1.ep7.el7 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7unaffected 0:7.1.14-4.GA_redhat_00003.1.ep7.el7 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7unaffected 0:2.0.41-7.SP8_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7unaffected 0:7.3.17-5.GA_redhat_00006.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4.24unaffected 2.2.39.Final-redhat-00001 < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7unaffected 0:2.2.39-1.Final_redhat_00001.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7unaffected 0:7.4.24-4.GA_redhat_00002.1.el7eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8unaffected 0:2.2.39-1.Final_redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8unaffected 0:7.4.24-4.GA_redhat_00002.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9unaffected 0:2.2.39-1.Final_redhat_00001.1.el9eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9unaffected 0:7.4.24-4.GA_redhat_00002.1.el9eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:1.83.0-1.redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:33.0.0-2.jre_redhat_00003.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:4.0.6-1.redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:1.0.0-3.redhat_00009.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:2.0.2-1.Final_redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8unaffected 0:2.3.23-1.SP3_redhat_00001.1.el8eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9unaffected 0:1.83.0-1.redhat_00001.1.el9eap < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9unaffected 0:33.0.0-2.jre_redhat_00003.1.el9eap < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD