Junglewise Threat Intelligence

CVE-2024-3884: Red Hat Undertow OutOfMemory denial of service in form parsing

CVE-2024-3884 · Severity: high · CVSS 7.5 · Published 2025-12-03

Vendors: Red Hat.

Executive brief

Undertow, a high-performance web server used in Red Hat JBoss and other Java applications, is vulnerable to a denial-of-service attack. An attacker can send specially crafted, large web forms that cause the server to run out of memory and crash. This can lead to service outages and impact business operations by making applications unavailable to legitimate users.

Technical details

A flaw was found in Undertow's FormEncodedDataDefinition.doParse(StreamSourceChannel) method. When the server attempts to parse large form data encoded with application/x-www-form-urlencoded, it fails to properly manage memory allocation, resulting in an OutOfMemory (OOM) condition. This vulnerability can be exploited by an unauthenticated remote attacker sending a large payload, leading to a complete denial of service. The issue has been addressed in various Red Hat JBoss EAP updates, including the upgrade to Undertow version 2.3.20.SP4-redhat-00001.

Affected products

  • Red Hat Undertow versions prior to 2.3.20.SP4-redhat-00001
  • Red Hat JBoss Enterprise Application Platform 8.1 versions prior to 8.1.3
  • Red Hat JBoss Enterprise Application Platform 7.4 versions prior to 2.2.39.Final-redhat-00001

Timeline

  • 2024-04-17: disclosed: Initial bug report in Red Hat Bugzilla
  • 2025-12-03: advisory: NVD publication date
  • 2026-01-08: patched: Red Hat released security updates for JBoss EAP 8.1.3

References