Strix
26.1K

CVE-2024-3884

HIGHCVSS 7.5/10EPSS 0.64%

Last modified

CVE-2024-3884 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. EPSS estimates a 0.64% chance of exploitation in the next 30 days.

Description

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
0.64%

47.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7All versions
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7All versions
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7All versions
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8All versions
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9All versions
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8All versions
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9All versions
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8All versions
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9All versions
Red HatOpenShift ServerlessAll versions
Red HatRed Hat build of Apache Camel 4 for Quarkus 3All versions
Red HatRed Hat build of Apache Camel for Spring Boot 3All versions
Red HatRed Hat build of Apache Camel for Spring Boot 4All versions
Red HatRed Hat build of Apache Camel - HawtIO 4All versions
Red HatRed Hat build of Apicurio Registry 2All versions
Red HatRed Hat Build of KeycloakAll versions
Red HatRed Hat build of OptaPlanner 8All versions
Red HatRed Hat build of QuarkusAll versions
Red HatRed Hat Data Grid 8All versions
Red HatRed Hat Fuse 7All versions
Red HatRed Hat Integration Camel K 1All versions
Red HatRed Hat Integration Camel Quarkus 2All versions
Red HatRed Hat JBoss Data Grid 7All versions
Red HatRed Hat JBoss Fuse Service Works 6All versions
Red HatRed Hat Process Automation 7All versions
Red HatRed Hat Single Sign-On 7All versions
Red Hatstreams for Apache KafkaAll versions

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2024-3884?
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.
How severe is CVE-2024-3884?
CVE-2024-3884 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.64% probability of exploitation in the next 30 days.
How do I fix CVE-2024-3884?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2024

View all 2024CVEs →

Are you affected by CVE-2024-3884?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST