Skip to content
fr Sign in
High

CVE-2024-3884 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

Description

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Affected products and versions

Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Versions not published
OpenShift Serverless Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apache Camel for Spring Boot 3 Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Show the 28 other branches
Product Affected versions Fixed in
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Integration Camel K 1 Versions not published
Red Hat Integration Camel Quarkus 2 Versions not published
Red Hat JBoss Data Grid 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat JBoss Fuse Service Works 6 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Single Sign-On 7 Versions not published
streams for Apache Kafka Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 2.2 earliest → < 2.2.39.Final-redhat-00001 2.2.39.Final-redhat-00001
Red Hat JBoss Enterprise Application Platform 7.4.24 2.2 earliest → < 2.2.39.Final-redhat-00001 2.2.39.Final-redhat-00001
Red Hat JBoss Enterprise Application Platform 8.1.6 2.3 earliest → < 2.3.24.SP2-redhat-00001 2.3.24.SP2-redhat-00001
Red Hat JBoss Enterprise Application Platform 8.1.3 2.3 earliest → < 2.3.20.SP4-redhat-00001 2.3.20.SP4-redhat-00001

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat JBoss Enterprise Application Platform 8

The 209 CVEs of Red Hat JBoss Enterprise Application Platform 8 →
CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High CVE-2026-120971 A flaw was found in RESTEasy's default exception mapper 5.3 Medium CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan 4.3 Medium
Track this CVE