Description
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Apicurio Registry 2 | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat Integration Camel K 1 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.2.39.Final | 2.2.39.Final | GHSA-33hj-rcmx-86mv |
| Maven | io.undertow:undertow-core | >= 2.4.0.Alpha1, < 2.4.0.Beta1 | 2.4.0.Beta1 | GHSA-33hj-rcmx-86mv |
| Maven | io.undertow:undertow-core | >= 2.3.0.Alpha1, < 2.3.21.Final | 2.3.21.Final | GHSA-33hj-rcmx-86mv |
Advisories 1
- WID-SEC-2026-0275 Red Hat Undertow: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 1, 2026
References
- https://access.redhat.com/security/cve/CVE-2024-4027 vdb-entry
- RHBZ#2276410 issue-tracking