CVE-2024-3884
High · 7.5CVSS
7.5
EPSS
1.4%
Published
Dec 3, 2025
CISA due date
—
The record
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | io.undertow:undertow-core | 0 | 2.2.39.Final |
| Maven | io.undertow:undertow-core | 2.3.0.Alpha1 | 2.3.21.Final |
| Maven | io.undertow:undertow-core | 2.4.0.Alpha1 | 2.4.0.Beta1 |
| Chainguard | wildfly-openjdk-17 | 0 | 39.0.0-r0 |
| Chainguard | wildfly-openjdk-21 | 0 | 39.0.0-r0 |
| Wolfi | wildfly-openjdk-17 | 0 | 39.0.0-r0 |
| Wolfi | wildfly-openjdk-21 | 0 | 39.0.0-r0 |
| maven | io.undertow/undertow-core | 2.4.0.Alpha1 | No fix |
Related vulnerabilities
- GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large… Also affects io.undertow:undertow-core
- CVE-2024-4027 A flaw was found in Undertow. Also affects io.undertow:undertow-core
- CVE-2025-12543 A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP… Also affects io.undertow:undertow-core
- CVE-2024-4109 undertow: information leakage via HTTP/2 request header reuse Also affects io.undertow:undertow-core
- CVE-2023-4639 A flaw was found in Undertow, which incorrectly parses cookies with certain… Also affects io.undertow:undertow-core
- CVE-2023-1973 A flaw was found in Undertow package. Also affects io.undertow:undertow-core
- CVE-2024-7885 A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same… Also affects io.undertow:undertow-core
- CVE-2024-3653 A vulnerability was found in Undertow. Also affects io.undertow:undertow-core