Description
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Fuse 7.12.1 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1.0 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6.5 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Decision Manager 7 | — | — |
| Red Hat | Red Hat Integration Camel K | — | — |
| Red Hat | Red Hat Integration Service Registry | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat JBoss Fuse 6 | — | — |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) Operational Tools | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat support for Spring Boot | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.3.18-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.9-1.redhat_00001.1.el7sso | RHSA-2023:4920, RHSA-2023:4919, RHSA-2023:4918 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis +15 | 1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-artemis-native +1 | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +4 | 2.10.4-3.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind +2 | 2.10.4-5.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-datatype-jdk8 +2 | 2.10.4-2.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-16.Final_redhat_00017.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.11-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-5.Final_redhat_00003.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-14.SP13_redhat_00001.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.10-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron +1 | 1.10.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.14-3.GA_redhat_00002.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-woodstox-core | 5.0.3-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.0.10-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat JBoss EAP 7 | eap7-jettison | 1.5.4-1.redhat_00002.1.el7eap | RHSA-2023:4507, RHSA-2023:4506, RHSA-2023:4505 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.25-3.SP3_redhat_00001.1.el7eap | RHSA-2023:4507, RHSA-2023:4506, RHSA-2023:4505 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.12-3.GA_redhat_00003.1.el7eap | RHSA-2023:4507, RHSA-2023:4506, RHSA-2023:4505 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.12-3.GA_redhat_00003.1.el8eap | RHSA-2023:4507, RHSA-2023:4506 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-parent | < 2.2.24.Final | 2.2.24.Final | GHSA-65h2-wf7m-q2v8 |
Advisories 9
- RHSA-2025:9583 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2023:4920 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.5 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2023:4918 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.5 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2023:4919 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.5 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2023:4506 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2023:4507 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2023:4505 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
References
- RHSA-2023:4505 vendor-advisory
- RHSA-2023:4506 vendor-advisory
- RHSA-2023:4507 vendor-advisory
- RHSA-2023:4509 vendor-advisory
- RHSA-2023:4918 vendor-advisory
- RHSA-2023:4919 vendor-advisory
- RHSA-2023:4920 vendor-advisory
- RHSA-2023:4921 vendor-advisory
- RHSA-2023:4924 vendor-advisory
- RHSA-2023:7247 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3223 vdb-entry
- RHBZ#2209689 issue-tracking
- https://security.netapp.com/advisory/ntap-20231027-0004/