CVE-2024-3884: Red Hat Undertow OutOfMemory denial of service in form parsing

CVE-2024-3884 · Severity: high · CVSS 7.5 · Published 2025-12-03

Undertow, a high-performance web server used in Red Hat JBoss and other Java applications, is vulnerable to a denial-of-service attack. An attacker can send specially crafted, large web forms that cause the server to run out of memory and crash. This can lead to service outages and impact business operations by making applications unavailable to legitimate users.

Technologies: io.undertow:undertow-core (Maven). Vendors: Maven, Red Hat.

Quick answers

Is CVE-2024-3884 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-3884 being exploited in the wild.
How severe is CVE-2024-3884?
High severity, with a CVSS score of 7.5, published 3 December 2025.
Which products and versions are affected?
io.undertow:undertow-core (Maven) ECOSYSTEM:introduced=0,fixed=2.2.39.Final; Red Hat JBoss Enterprise Application Platform 7.4 versions prior to 2.2.39.Final-redhat-00001; Red Hat JBoss Enterprise Application Platform 8.1 versions prior to 8.1.3.
Is there a fix for CVE-2024-3884?
Yes. io.undertow:undertow-core (Maven): upgrade to 2.2.39.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-3884 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-3884?
Check whether you run io.undertow:undertow-core (Maven), Red Hat JBoss Enterprise Application Platform 7.4 or Red Hat JBoss Enterprise Application Platform 8.1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.undertow:undertow-core (Maven): upgrade to 2.2.39.Final or later
    # set io.undertow:undertow-core to 2.2.39.Final in your pom.xml or build.gradle

Technical details

A flaw was found in Undertow's FormEncodedDataDefinition.doParse(StreamSourceChannel) method. When the server attempts to parse large form data encoded with application/x-www-form-urlencoded, it fails to properly manage memory allocation, resulting in an OutOfMemory (OOM) condition. This vulnerability can be exploited by an unauthenticated remote attacker sending a large payload, leading to a complete denial of service. The issue has been addressed in various Red Hat JBoss EAP updates, including the upgrade to Undertow version 2.3.20.SP4-redhat-00001.

Affected products

  • Red Hat Undertow versions prior to 2.3.20.SP4-redhat-00001
  • Red Hat JBoss Enterprise Application Platform 8.1 versions prior to 8.1.3
  • Red Hat JBoss Enterprise Application Platform 7.4 versions prior to 2.2.39.Final-redhat-00001

Identifiers

  • CVE-2024-3884
  • GHSA-6h4f-pj3g-q8fq

Timeline

  • 2024-04-17: disclosed: Initial bug report in Red Hat Bugzilla
  • 2025-12-03: advisory: NVD publication date
  • 2026-01-08: patched: Red Hat released security updates for JBoss EAP 8.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.