Public vulnerability disclosure
CVE-2024-3884
Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
publishedCWE-20
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
Technical severity7.5 highCVSS 3.1 · ADP: CISA-ADP
Published2025-12-03Source updated 2026-11-05
Collected2026-11-052 attributed sources
Fixes and workarounds
Workaround
It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.4.18-19.SP17_redhat_00001.1.ep7.el7; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.1.14-4.GA_redhat_00003.1.ep7.el7; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.41-7.SP8_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.3.17-5.GA_redhat_00006.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4.24 Red Hat io.undertow/undertow-core
https://access.redhat.com/downloads/content/package-browser/ |
≥ 2.2.39.Final-redhat-00001; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.39-1.Final_redhat_00001.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.24-4.GA_redhat_00002.1.el7eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.39-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.24-4.GA_redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.39-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Red Hat eap7-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:7.4.24-4.GA_redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-bouncycastle
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.83.0-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-guava-libraries
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:33.0.0-2.jre_redhat_00003.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-jaxb
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.6-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-jcip-annotations
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.0-3.redhat_00009.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-slf4j-jboss-logmanager
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.2-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.23-1.SP3_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-bouncycastle
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.83.0-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-guava-libraries
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:33.0.0-2.jre_redhat_00003.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-jaxb
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.6-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-jcip-annotations
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.0-3.redhat_00009.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-slf4j-jboss-logmanager
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.2-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.23-1.SP3_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1.3 Red Hat io.undertow/undertow-core
https://access.redhat.com/downloads/content/package-browser/ |
≥ 2.3.20.SP4-redhat-00001; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-apache-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.10-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-bouncycastle
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.82.0-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:801.3.0-1.GA_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-eventstream
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.1-3.redhat_00003.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-hibernate
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:6.6.36-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-jboss-el-api_5.0_spec
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.2-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-jboss-threads
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.5.0-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.20-2.SP4_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.1.3-4.GA_redhat_00006.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-wildfly-clustering
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:5.0.12-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-wildfly-elytron
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.6.6-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Red Hat eap8-wildfly-javadocs
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.1.1-4.GA_redhat_00007.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-apache-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.10-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-bouncycastle
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.82.0-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:801.3.0-1.GA_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-eventstream
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.0.1-3.redhat_00003.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-hibernate
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:6.6.36-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-jboss-el-api_5.0_spec
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.2-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-jboss-threads
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.5.0-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-undertow
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.20-2.SP4_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.1.3-4.GA_redhat_00006.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-wildfly-clustering
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:5.0.12-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-wildfly-elytron
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.6.6-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Red Hat eap8-wildfly-javadocs
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.1.1-4.GA_redhat_00007.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| OpenShift Serverless Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat build of Apache Camel 4 for Quarkus 3 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat build of Apache Camel for Spring Boot 3 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat build of Apache Camel for Spring Boot 4 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat build of Apache Camel - HawtIO 4 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat build of Apicurio Registry 2 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Build of Keycloak Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat build of OptaPlanner 8 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat build of Quarkus Red Hat quarkus-undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Data Grid 8 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Fuse 7 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Integration Camel K 1 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Integration Camel Quarkus 2 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat JBoss Data Grid 7 Red Hat undertow
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 7 Red Hat undertow
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html |
Range not reported
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat undertow
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Fuse Service Works 6 Red Hat undertow
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Process Automation 7 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Single Sign-On 7 Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| streams for Apache Kafka Red Hat undertow
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | ADP: CISA-ADP |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2026:0383CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:0384CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:0386CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3889CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3891CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3892CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4915CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4916CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4917CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4924CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6011CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6012CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-3884CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2275287CNA: redhat · issue-tracking, x_refsource_REDHAT
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.