Skip to content
Fencer Vulns
high 7.5

CVE-2024-3884 json

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

published 2025-12-03 11 mo ago modified 2026-11-05 3 d ago also GHSA-6h4f-pj3g-q8fq , EUVD-2024-32452

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Patch / fix

  • maven io.undertow:undertow-core 2.2.39.Final, 2.3.21.Final, 2.4.0.Beta1
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 0:1.4.18-19.SP17_redhat_00001.1.ep7.el7, 0:7.1.14-4.GA_redhat_00003.1.ep7.el7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 0:2.0.41-7.SP8_redhat_00001.1.el7eap, 0:7.3.17-5.GA_redhat_00006.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4.24 2.2.39.Final-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.2.39-1.Final_redhat_00001.1.el7eap, 0:7.4.24-4.GA_redhat_00002.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:2.2.39-1.Final_redhat_00001.1.el8eap, 0:7.4.24-4.GA_redhat_00002.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:2.2.39-1.Final_redhat_00001.1.el9eap, 0:7.4.24-4.GA_redhat_00002.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:1.0.0-3.redhat_00009.1.el8eap, 0:1.83.0-1.redhat_00001.1.el8eap, 0:2.0.2-1.Final_redhat_00001.1.el8eap, 0:2.3.23-1.SP3_redhat_00001.1.el8eap, 0:4.0.6-1.redhat_00001.1.el8eap, 0:33.0.0-2.jre_redhat_00003.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:1.0.0-3.redhat_00009.1.el9eap, 0:1.83.0-1.redhat_00001.1.el9eap, 0:2.0.2-1.Final_redhat_00001.1.el9eap, 0:2.3.23-1.SP3_redhat_00001.1.el9eap, 0:4.0.6-1.redhat_00001.1.el9eap, 0:33.0.0-2.jre_redhat_00003.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.3 2.3.20.SP4-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:1.0.1-3.redhat_00003.1.el8eap, 0:1.82.0-1.redhat_00001.1.el8eap, 0:2.3.20-2.SP4_redhat_00001.1.el8eap, 0:2.5.0-1.redhat_00001.1.el8eap, 0:2.6.6-1.Final_redhat_00001.1.el8eap, 0:4.0.2-1.Final_redhat_00001.1.el8eap, 0:4.0.10-1.redhat_00001.1.el8eap, 0:5.0.12-1.Final_redhat_00001.1.el8eap, 0:6.6.36-1.Final_redhat_00001.1.el8eap, 0:8.1.1-4.GA_redhat_00007.1.el8eap, 0:8.1.3-4.GA_redhat_00006.1.el8eap, 0:801.3.0-1.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:1.0.1-3.redhat_00003.1.el9eap, 0:1.82.0-1.redhat_00001.1.el9eap, 0:2.3.20-2.SP4_redhat_00001.1.el9eap, 0:2.5.0-1.redhat_00001.1.el9eap, 0:2.6.6-1.Final_redhat_00001.1.el9eap, 0:4.0.2-1.Final_redhat_00001.1.el9eap, 0:4.0.10-1.redhat_00001.1.el9eap, 0:5.0.12-1.Final_redhat_00001.1.el9eap, 0:6.6.36-1.Final_redhat_00001.1.el9eap, 0:8.1.1-4.GA_redhat_00007.1.el9eap, 0:8.1.3-4.GA_redhat_00006.1.el9eap, 0:801.3.0-1.GA_redhat_00001.1.el9eap
  • eap8-jaxb jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap
  • eap8-txw2 jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap
  • eap8-xsom jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap
  • eap8-guava jboss enterprise application platform 8.0 33.0.0-2.jre_redhat_00003.1.el9eap
  • eap8-rngom jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap
  • eap8-jaxb-jxc jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap
  • eap8-jaxb-xjc jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap
  • eap8-undertow jboss enterprise application platform 8.0 2.3.23-1.SP3_redhat_00001.1.el9eap

red hat advisories RHSA-2026:6012RHSA-2026:6011RHSA-2026:4916RHSA-2026:4917RHSA-2026:4915RHSA-2026:3891

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-3884 updated

undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

  • Red Hat Fuse 7 undertow undertow Red Hat JBoss Data Grid 7 undertow undertow
    affected: workaround, no fix planned “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.”
  • Red Hat JBoss Enterprise Application Platform 7 undertow undertow
    affected: workaround, no fix available “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.”
  • Red Hat JBoss Fuse Service Works 6 undertow undertow Red Hat Process Automation 7 undertow undertow
    affected: workaround, no fix planned “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.”
  • Red Hat OpenShift Serverless undertow undertow Red Hat build of Apache Camel - HawtIO 4 undertow undertow Red Hat build of Apache Camel 4 for Quarkus 3 undertow undertow Red Hat build of Apache Camel for Spring Boot 3 undertow undertow Red Hat build of Apache Camel for Spring Boot 4 undertow undertow Red Hat build of Apicurio Registry 2 undertow undertow
    +8 more products
    Red Hat Build of Keycloak undertow undertow Red Hat build of OptaPlanner 8 undertow undertow Red Hat build of Quarkus quarkus-undertow Red Hat Data Grid 8 undertow undertow Red Hat Integration Camel K 1 undertow undertow Red Hat Integration Camel Quarkus 2 undertow undertow Red Hat Single Sign-On 7 undertow undertow Red Hat streams for Apache Kafka undertow undertow
    under investigation
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el7eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el7eap
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:4915
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el8eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el8eap, +1 more
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:4916
  • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el9eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el9eap, +1 more
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:4917
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-jaxb 4.0.6-1.redhat_00001.1.el8eap, eap8-txw2 4.0.6-1.redhat_00001.1.el8eap, eap8-xsom 4.0.6-1.redhat_00001.1.el8eap, eap8-rngom 4.0.6-1.redhat_00001.1.el8eap, eap8-jaxb-jxc 4.0.6-1.redhat_00001.1.el8eap, eap8-jaxb-xjc 4.0.6-1.redhat_00001.1.el8eap, +15 more
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:3889
show 9 more
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-jaxb 4.0.6-1.redhat_00001.1.el9eap, eap8-txw2 4.0.6-1.redhat_00001.1.el9eap, eap8-xsom 4.0.6-1.redhat_00001.1.el9eap, eap8-rngom 4.0.6-1.redhat_00001.1.el9eap, eap8-jaxb-jxc 4.0.6-1.redhat_00001.1.el9eap, eap8-jaxb-xjc 4.0.6-1.redhat_00001.1.el9eap, +15 more
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:3891
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wildfly 8.1.3-4.GA_redhat_00006.1.el8eap, eap8-apache-cxf 4.0.10-1.redhat_00001.1.el8eap, eap8-eventstream 1.0.1-3.redhat_00003.1.el8eap, eap8-bouncycastle 1.82.0-1.redhat_00001.1.el8eap, eap8-jboss-threads 2.5.0-1.redhat_00001.1.el8eap, eap8-undertow 2.3.20-2.SP4_redhat_00001.1.el8eap, +40 more
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:0383
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-wildfly 8.1.3-4.GA_redhat_00006.1.el9eap, eap8-apache-cxf 4.0.10-1.redhat_00001.1.el9eap, eap8-eventstream 1.0.1-3.redhat_00003.1.el9eap, eap8-bouncycastle 1.82.0-1.redhat_00001.1.el9eap, eap8-jboss-threads 2.5.0-1.redhat_00001.1.el9eap, eap8-undertow 2.3.20-2.SP4_redhat_00001.1.el9eap, +40 more
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:0384
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.14-4.GA_redhat_00003.1.ep7.el7, eap7-undertow 1.4.18-19.SP17_redhat_00001.1.ep7.el7, eap7-wildfly-modules 7.1.14-4.GA_redhat_00003.1.ep7.el7
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:6012
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-undertow 2.0.41-7.SP8_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-wildfly-javadocs 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-wildfly-java-jdk8 7.3.17-5.GA_redhat_00006.1.el7eap, eap7-wildfly-java-jdk11 7.3.17-5.GA_redhat_00006.1.el7eap
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:6011
  • Red Hat JBoss Enterprise Application Platform 7.4.24 undertow-core 2.2.39.Final-redhat-00001
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:4924
  • Red Hat JBoss Enterprise Application Platform 8.0
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:3892
  • Red Hat JBoss Enterprise Application Platform 8.1.3 undertow-core 2.3.20.SP4-redhat-00001
    fixed: vendor fix “It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.” RHSA-2026:0386
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-netty 4.1.124-1.Final_redhat_00001.1.el7eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el7eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el7eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.124-1.Final_redhat_00001.1.el7eap, +74 more Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-netty 4.1.124-1.Final_redhat_00001.1.el8eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el8eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el8eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.124-1.Final_redhat_00001.1.el8eap, +74 more Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-netty 4.1.124-1.Final_redhat_00001.1.el9eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el9eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el9eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el9eap, eap7-apache-cxf-rt 3.5.11-1.SP1_redhat_00001.1.el9eap, +71 more Red Hat JBoss EAP 8.0 for RHEL 8 eap8-gson 2.10.1-1.redhat_00005.1.el8eap, eap8-jose4j 0.9.6-2.redhat_00002.1.el8eap, eap8-yasson 3.0.4-2.redhat_00006.1.el8eap, eap8-javaewah 1.2.3-1.redhat_00002.1.el8eap, eap8-apache-cxf 4.0.10-2.redhat_00001.1.el8eap, eap8-wildfly 8.0.12-5.GA_redhat_00008.1.el8eap, +63 more Red Hat JBoss EAP 8.0 for RHEL 9 eap8-gson 2.10.1-1.redhat_00005.1.el9eap, eap8-jose4j 0.9.6-2.redhat_00002.1.el9eap, eap8-yasson 3.0.4-2.redhat_00006.1.el9eap, eap8-javaewah 1.2.3-1.redhat_00002.1.el9eap, eap8-apache-cxf 4.0.10-2.redhat_00001.1.el9eap, eap8-wildfly 8.0.12-5.GA_redhat_00008.1.el9eap, +63 more Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf 3.1.16-6.redhat_00006.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-6.redhat_00006.1.ep7.el7, eap7-hibernate 5.1.17-4.Final_redhat_00005.1.ep7.el7, eap7-jbossws-cxf 5.1.11-1.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-tools 3.1.16-6.redhat_00006.1.ep7.el7, eap7-apache-cxf-services 3.1.16-6.redhat_00006.1.ep7.el7, +5 more
    +3 more products
    Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf 3.4.10-3.SP2_redhat_00003.1.el7eap, eap7-jbossws-cxf 5.3.0-2.SP1_redhat_00002.1.el7eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el7eap, eap7-apache-cxf-rt 3.4.10-3.SP2_redhat_00003.1.el7eap, eap7-apache-cxf-tools 3.4.10-3.SP2_redhat_00003.1.el7eap, eap7-hibernate-core 5.3.38-1.Final_redhat_00001.1.el7eap, +27 more Red Hat JBoss Enterprise Application Platform 7.4.24 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1552 more Red Hat JBoss Enterprise Application Platform 8.1.3 pom.xml, aesh 2.4, c3 0.6.4, d3 7.4.3, he 1.2.0, lr 1.4.2, +1858 more
    not affected: vulnerable code not present

1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
11 mo ago

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.undertow:undertow-core
<2.2.39.Final
>=2.4.0.Alpha1, <2.4.0.Beta1
>=2.3.0.Alpha1, <2.3.21.Final
2.2.39.Final
2.4.0.Beta1
2.3.21.Final

Affected products

  • Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4.24
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.3
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat Integration Camel Quarkus 2
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Fuse Service Works 6
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.