Junglewise Threat Intelligence

CVE-2024-4027: Red Hat Undertow denial of service via OutOfMemoryError in getParameterNames

CVE-2024-4027 · Severity: high · CVSS 7.5 · Published 2026-01-30

Technologies: Red Hat Fuse 7, Red Hat build of Apicurio Registry 2. Vendors: Red Hat.

Executive brief

Undertow is a flexible web server used in many Java-based applications and Red Hat products. A flaw allows an unauthorized remote attacker to crash the server by sending a request with excessively large parameter names. This results in a denial-of-service, making the affected application or service unavailable to legitimate users.

Technical details

A vulnerability exists in Undertow's HttpServletRequestImpl.getParameterNames() method due to improper input validation of request parameters. An unauthenticated remote attacker can send a specially crafted HTTP request containing extremely large parameter names. When a servlet calls the affected method to process these parameters, it triggers an OutOfMemoryError (OOM), causing the Java Virtual Machine (JVM) to crash or become unresponsive. This results in a denial-of-service (DoS) condition for any application using the vulnerable Undertow library.

Affected products

  • Red Hat Undertow
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Fuse Service Works 6
  • Red Hat Red Hat Process Automation 7
  • Red Hat OpenShift Serverless

Timeline

  • 2024-01-01: disclosed
  • 2026-01-30: advisory

References

Related threats