Executive brief
Undertow is a flexible web server used in many Java-based applications and Red Hat products. A flaw allows an unauthorized remote attacker to crash the server by sending a request with excessively large parameter names. This results in a denial-of-service, making the affected application or service unavailable to legitimate users.
Technical details
A vulnerability exists in Undertow's HttpServletRequestImpl.getParameterNames() method due to improper input validation of request parameters. An unauthenticated remote attacker can send a specially crafted HTTP request containing extremely large parameter names. When a servlet calls the affected method to process these parameters, it triggers an OutOfMemoryError (OOM), causing the Java Virtual Machine (JVM) to crash or become unresponsive. This results in a denial-of-service (DoS) condition for any application using the vulnerable Undertow library.
Affected products
- Red Hat Undertow
- Red Hat Red Hat build of Quarkus
- Red Hat Red Hat build of Apicurio Registry 2
- Red Hat Red Hat Fuse 7
- Red Hat Red Hat Integration Camel K 1
- Red Hat Red Hat JBoss Data Grid 7
- Red Hat Red Hat JBoss Fuse Service Works 6
- Red Hat Red Hat Process Automation 7
- Red Hat OpenShift Serverless
Timeline
- 2024-01-01: disclosed
- 2026-01-30: advisory
References
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
- https://access.redhat.com/security/cve/CVE-2024-4027
- https://bugzilla.redhat.com/show_bug.cgi?id=2276410
- https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-4027.json