CVE-2024-4027
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Jan 30, 2026
CISA due date
—
The record
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | io.undertow:undertow-core | 0 | 2.2.39.Final |
| Maven | io.undertow:undertow-core | 2.3.0.Alpha1 | 2.3.21.Final |
| Maven | io.undertow:undertow-core | 2.4.0.Alpha1 | 2.4.0.Beta1 |
Related vulnerabilities
- GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large… Same vulnerability
- CVE-2025-12543 A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP… Also affects io.undertow:undertow-core
- CVE-2024-3884 A flaw was found in Undertow that can cause remote denial of service attacks. Also affects io.undertow:undertow-core
- CVE-2024-4109 undertow: information leakage via HTTP/2 request header reuse Also affects io.undertow:undertow-core
- CVE-2023-4639 A flaw was found in Undertow, which incorrectly parses cookies with certain… Also affects io.undertow:undertow-core
- CVE-2023-1973 A flaw was found in Undertow package. Also affects io.undertow:undertow-core
- CVE-2024-7885 A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same… Also affects io.undertow:undertow-core
- CVE-2024-3653 A vulnerability was found in Undertow. Also affects io.undertow:undertow-core