Undertow OOM DoS via Large application/x-www-form-urlencoded
CVE-2024-3884 Published on December 3, 2025

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-3884 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 596 days later.

Weakness Type

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.


Products Associated with CVE-2024-3884

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Serverless
 
Red Hat Camel Quarkus
 
Red Hat Camel Spring Boot
 
Red Hat Apache Camel Hawtio
 
Red Hat Service Registry
 
Red Hat Build Keycloak
 
Red Hat Optaplanner
 
Red Hat Quarkus
 
Red Hat Jboss Data Grid
 
Red Hat Jboss Fuse
 
Red Hat Integration
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Jboss Fuse Service Works
 
Red Hat Jboss Enterprise Bpms Platform
 
Red Hat Single Sign On
 
Red Hat Amq Streams
 
Red Hat Undertow
 

Affected Versions

Red Hat JBoss Enterprise Application Platform 8.0: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: Red Hat JBoss Enterprise Application Platform 8.1: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: Red Hat OpenShift Serverless: Red Hat build of Apache Camel 4 for Quarkus 3: Red Hat build of Apache Camel for Spring Boot 3: Red Hat build of Apache Camel for Spring Boot 4: Red Hat build of Apache Camel - HawtIO 4: Red Hat build of Apicurio Registry 2: Red Hat Build of Keycloak: Red Hat build of OptaPlanner 8: Red Hat build of Quarkus: Red Hat build of Quarkus: Red Hat Data Grid 8: Red Hat Fuse 7: Red Hat Integration Camel K 1: Red Hat Integration Camel Quarkus 2: Red Hat JBoss Data Grid 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Fuse Service Works 6: Red Hat Process Automation 7: Red Hat Single Sign-On 7: Red Hat streams for Apache Kafka:

Exploit Probability

EPSS
0.37%
Percentile
58.34%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.