GHSA-33hj-rcmx-86mv
High · 7.5CVSS
7.5
EPSS
—
Published
Jan 30, 2026
CISA due date
—
The record
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | io.undertow:undertow-core | 0 | 2.2.39.Final |
| Maven | io.undertow:undertow-core | 2.3.0.Alpha1 | 2.3.21.Final |
| Maven | io.undertow:undertow-core | 2.4.0.Alpha1 | 2.4.0.Beta1 |
Related vulnerabilities
- CVE-2024-4027 A flaw was found in Undertow. Same vulnerability
- CVE-2025-12543 A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP… Also affects io.undertow:undertow-core
- CVE-2024-3884 A flaw was found in Undertow that can cause remote denial of service attacks. Also affects io.undertow:undertow-core
- CVE-2024-4109 undertow: information leakage via HTTP/2 request header reuse Also affects io.undertow:undertow-core
- CVE-2023-4639 A flaw was found in Undertow, which incorrectly parses cookies with certain… Also affects io.undertow:undertow-core
- CVE-2023-1973 A flaw was found in Undertow package. Also affects io.undertow:undertow-core
- CVE-2024-7885 A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same… Also affects io.undertow:undertow-core
- CVE-2024-3653 A vulnerability was found in Undertow. Also affects io.undertow:undertow-core