Skip to content
OpenAdvisories
High · 7.5 CVE-2023-1973 EUVD-2024-3227GHSA-97cq-f4jm-mv8h

Undertow: unrestricted request storage leads to memory exhaustion

Published Nov 7, 2024 · Updated Nov 7, 2024 · Assigned by redhat

Vendor: Red Hat Product: Red Hat JBoss Enterprise Application Platform 7 Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Product: Red Hat JBoss Enterprise Application Platform 8 Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Package: io.undertow:undertow-core Package: undertow Package: undertow Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat JBoss Enterprise Application Platform 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 undertow 2.3.18-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 undertow No fix yet —
Ubuntu 26.04 LTS undertow No fix yet —
Ubuntu 25.10 undertow No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 22.04 LTS undertow No fix yet —
Ubuntu Pro 20.04 LTS undertow No fix yet —
Ubuntu Pro 18.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-activemq-artemis +15 1.5.5.016-1.redhat_00001.1.ep7.el7 RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-artemis-native +1 1:1.5.5.016-1.redhat_00001.1.ep7.el7 RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-core +4 2.10.4-3.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind +2 2.10.4-5.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-datatype-jdk8 +2 2.10.4-2.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-server-migration +21 1.7.2-16.Final_redhat_00017.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-xnio-base 3.5.11-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jsoup 1.14.2-1.redhat_00002.1.ep7.el7 RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-5.Final_redhat_00003.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-14.SP13_redhat_00001.1.ep7.el7 RHSA-2025:9583, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.10-2.GA_redhat_00002.1.ep7.el7 RHSA-2025:9583, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron +1 1.10.17-1.Final_redhat_00001.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-javadocs +2 7.3.14-3.GA_redhat_00002.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-woodstox-core 5.0.3-2.redhat_00002.1.ep7.el7 RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-xml-security 2.0.10-2.redhat_00002.1.ep7.el7 RHSA-2025:4226
Red Hat JBoss EAP 8 eap8-undertow 2.3.11-1.SP1_redhat_00001.1.el8eap RHSA-2024:2764
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.16.0-18.redhat_00052.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.4.10-2.redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-eclipse-jgit 5.13.3.202401111512-1.r_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-elytron-web +1 1.9.4-1.Final_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-hal-console 3.3.21-1.Final_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.36-1.Final_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-infinispan +9 11.0.18-2.Final_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-jberet +1 1.3.9-3.SP3_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-jboss-annotations-api_1.3_spec 2.0.1-3.Final_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-jboss-cert-helper +1 1.1.2-1.redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.27-4.SP2_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-35.Final_redhat_00034.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.12-1.SP2_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-jgroups-kubernetes 1.0.17-1.Final_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-lucene-core +7 5.5.5-6.redhat_2.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-lucene-grouping 5.5.5-6.redhat_2.1.el8eap RHSA-2024:1675
Red Hat JBoss EAP 7 eap7-undertow 2.2.30-1.SP1_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.16-4.GA_redhat_00002.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.22-1.Final_redhat_00001.1.el7eap RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.16-4.GA_redhat_00002.1.el8eap RHSA-2024:1676, RHSA-2024:1675

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.undertow:undertow-core < 2.2.32.Final 2.2.32.Final GHSA-97cq-f4jm-mv8h
Maven io.undertow:undertow-core >= 2.3.0.Alpha1, < 2.3.13.Final 2.3.13.Final GHSA-97cq-f4jm-mv8h

Advisories 7

References