CVE-2024-4027: Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.3.21.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4027?
CVE-2024-4027 is classified as a medium severity vulnerability due to its potential for remote denial of service attacks.
How do I fix CVE-2024-4027?
To mitigate CVE-2024-4027, it's recommended to limit the length of HTTP parameter names in your application or update to the latest version of Undertow that addresses this issue.
What is the impact of CVE-2024-4027 on my application?
CVE-2024-4027 can lead to an OutOfMemoryError in applications that handle requests with excessively long parameter names, potentially crashing the server.
Which software is affected by CVE-2024-4027?
CVE-2024-4027 affects Undertow when servlets utilize the HttpServletRequestImpl.getParameterNames() method.
Can CVE-2024-4027 be exploited remotely?
Yes, CVE-2024-4027 can be exploited remotely through crafted HTTP requests with large parameter names.