CVE-2024-3884: Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
Other sources
There exists a security vulnerability in Undertow that can cause remote DoS attacks. When server uses method FormEncodedDataDefinition.doParse(StreamSourceChannel) to parse large form data encoding with application/x-www-form-urlencoded, the method will cause OutOfMemory. This vulnerability can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack.
This happens because there is no size limit for this method hence a large request may jeopardize the environment leading to DoS.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3884?
CVE-2024-3884 has been classified as a high severity vulnerability due to its potential for remote denial of service attacks.
How do I fix CVE-2024-3884?
To fix CVE-2024-3884, it is recommended to update to the latest version of Undertow that addresses this flaw.
What does CVE-2024-3884 affect?
CVE-2024-3884 specifically affects the Undertow web server when parsing large form data with application/x-www-form-urlencoded.
What is the impact of CVE-2024-3884?
The impact of CVE-2024-3884 is an OutOfMemory error that can potentially lead to a denial of service condition on the server.
Is CVE-2024-3884 easy to exploit?
CVE-2024-3884 can be exploited remotely, making it relatively straightforward for an attacker to initiate a denial of service attack.