# CVE-2024-3884: Red Hat Undertow OutOfMemory denial of service in form parsing

Source: https://junglewise.ai/threats/cve-2024-3884-red-hat-undertow-outofmemory-denial-of-service-in-form-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-03. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2024-3884 · Severity: high · CVSS 7.5 · Published 2025-12-03

Undertow, a high-performance web server used in Red Hat JBoss and other Java applications, is vulnerable to a denial-of-service attack. An attacker can send specially crafted, large web forms that cause the server to run out of memory and crash. This can lead to service outages and impact business operations by making applications unavailable to legitimate users.

Technologies: [io.undertow:undertow-core (Maven)](https://junglewise.ai/threats/technologies/io-undertow-undertow-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2024-3884 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-3884 being exploited in the wild.

**How severe is CVE-2024-3884?** High severity, with a CVSS score of 7.5, published 3 December 2025.

**Which products and versions are affected?** io.undertow:undertow-core (Maven) ECOSYSTEM:introduced=0,fixed=2.2.39.Final; Red Hat JBoss Enterprise Application Platform 7.4 versions prior to 2.2.39.Final-redhat-00001; Red Hat JBoss Enterprise Application Platform 8.1 versions prior to 8.1.3.

**Is there a fix for CVE-2024-3884?** Yes. io.undertow:undertow-core (Maven): upgrade to 2.2.39.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-3884 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-3884?** Check whether you run io.undertow:undertow-core (Maven), Red Hat JBoss Enterprise Application Platform 7.4 or Red Hat JBoss Enterprise Application Platform 8.1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.undertow:undertow-core (Maven): upgrade to 2.2.39.Final or later

  ```sh
  # set io.undertow:undertow-core to 2.2.39.Final in your pom.xml or build.gradle
  ```


## Technical details

A flaw was found in Undertow's FormEncodedDataDefinition.doParse(StreamSourceChannel) method. When the server attempts to parse large form data encoded with application/x-www-form-urlencoded, it fails to properly manage memory allocation, resulting in an OutOfMemory (OOM) condition. This vulnerability can be exploited by an unauthenticated remote attacker sending a large payload, leading to a complete denial of service. The issue has been addressed in various Red Hat JBoss EAP updates, including the upgrade to Undertow version 2.3.20.SP4-redhat-00001.

## Affected products

- Red Hat Undertow versions prior to 2.3.20.SP4-redhat-00001
- Red Hat JBoss Enterprise Application Platform 8.1 versions prior to 8.1.3
- Red Hat JBoss Enterprise Application Platform 7.4 versions prior to 2.2.39.Final-redhat-00001

## Identifiers

- CVE-2024-3884
- GHSA-6h4f-pj3g-q8fq

## Timeline

- 2024-04-17: disclosed: Initial bug report in Red Hat Bugzilla
- 2025-12-03: advisory: NVD publication date
- 2026-01-08: patched: Red Hat released security updates for JBoss EAP 8.1.3

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)
- [https://access.redhat.com/errata/RHSA-2026:0383](https://access.redhat.com/errata/RHSA-2026:0383)
- [https://access.redhat.com/errata/RHSA-2026:0384](https://access.redhat.com/errata/RHSA-2026:0384)
- [https://access.redhat.com/errata/RHSA-2026:0386](https://access.redhat.com/errata/RHSA-2026:0386)
- [https://access.redhat.com/errata/RHSA-2026:3889](https://access.redhat.com/errata/RHSA-2026:3889)
- [https://access.redhat.com/errata/RHSA-2026:3891](https://access.redhat.com/errata/RHSA-2026:3891)

## Related threats

- [Red Hat Undertow resource exhaustion in HTTP request parsing](https://junglewise.ai/threats/cve-2026-3260-red-hat-undertow-resource-exhaustion-in-http-request-parsing)
- [Red Hat Undertow denial of service via OutOfMemoryError in getParameterNames](https://junglewise.ai/threats/cve-2024-4027-red-hat-undertow-denial-of-service-via-outofmemoryerror-in)
- [Red Hat Undertow improper Host header validation](https://junglewise.ai/threats/cve-2025-12543-red-hat-undertow-improper-host-header-validation)
- [Red Hat Undertow denial of service via MadeYouReset attack](https://junglewise.ai/threats/cve-2025-9784-red-hat-undertow-denial-of-service-via-madeyoureset-attack)
- [Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse](https://junglewise.ai/threats/cve-2024-4109-withdrawn-advisory-undertow-information-leakage-via-http-2-request)