CVE-2024-3884

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

High7.5EPSS 1.5%

Published: 3 Dec 2025
Updated: 5 Nov 2026
Reserved: 16 Apr 2024
Assigned by: redhat

Description

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Timeline

2024
16 Apr 2024
16 Apr 2024
ID reserved
By redhat
2025
3 Dec 202520 months later
3 Dec 2025· 20 months later
Published
2026
5 Nov 202611 months later
5 Nov 2026· 11 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-3884, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Deferred	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 1.5% · top 26% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

CWE-20: Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs

Affected products

Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
- unaffected 0:1.4.18-19.SP17_redhat_00001.1.ep7.el7 – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
- unaffected 0:7.1.14-4.GA_redhat_00003.1.ep7.el7 – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
- unaffected 0:2.0.41-7.SP8_redhat_00001.1.el7eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
- unaffected 0:7.3.17-5.GA_redhat_00006.1.el7eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4.24
- unaffected 2.2.39.Final-redhat-00001 – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- unaffected 0:2.2.39-1.Final_redhat_00001.1.el7eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- unaffected 0:7.4.24-4.GA_redhat_00002.1.el7eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
- unaffected 0:2.2.39-1.Final_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
- unaffected 0:7.4.24-4.GA_redhat_00002.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
- unaffected 0:2.2.39-1.Final_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
- unaffected 0:7.4.24-4.GA_redhat_00002.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0
All versions: unaffected
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
- unaffected 0:1.83.0-1.redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
- unaffected 0:33.0.0-2.jre_redhat_00003.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
- unaffected 0:4.0.6-1.redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
- unaffected 0:1.0.0-3.redhat_00009.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
- unaffected 0:2.0.2-1.Final_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
- unaffected 0:2.3.23-1.SP3_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
- unaffected 0:1.83.0-1.redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
- unaffected 0:33.0.0-2.jre_redhat_00003.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
- unaffected 0:4.0.6-1.redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
- unaffected 0:1.0.0-3.redhat_00009.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
- unaffected 0:2.0.2-1.Final_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
- unaffected 0:2.3.23-1.SP3_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1.3
- unaffected 2.3.20.SP4-redhat-00001 – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:4.0.10-1.redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:1.82.0-1.redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:801.3.0-1.GA_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:1.0.1-3.redhat_00003.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:6.6.36-1.Final_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:4.0.2-1.Final_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:2.5.0-1.redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:2.3.20-2.SP4_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:8.1.3-4.GA_redhat_00006.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:5.0.12-1.Final_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:2.6.6-1.Final_redhat_00001.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- unaffected 0:8.1.1-4.GA_redhat_00007.1.el8eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:4.0.10-1.redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:1.82.0-1.redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:801.3.0-1.GA_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:1.0.1-3.redhat_00003.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:6.6.36-1.Final_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:4.0.2-1.Final_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:2.5.0-1.redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:2.3.20-2.SP4_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:8.1.3-4.GA_redhat_00006.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:5.0.12-1.Final_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:2.6.6-1.Final_redhat_00001.1.el9eap – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- unaffected 0:8.1.1-4.GA_redhat_00007.1.el9eap – < *
Red Hat · OpenShift Serverless
All versions: unknown
Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3
All versions: unknown
Red Hat · Red Hat build of Apache Camel for Spring Boot 3
All versions: unknown
Red Hat · Red Hat build of Apache Camel for Spring Boot 4
All versions: unknown
Red Hat · Red Hat build of Apache Camel - HawtIO 4
All versions: unknown
Red Hat · Red Hat build of Apicurio Registry 2
All versions: unknown
Red Hat · Red Hat Build of Keycloak
All versions: unknown
Red Hat · Red Hat build of OptaPlanner 8
All versions: unknown
Red Hat · Red Hat build of Quarkus
All versions: unknown
Red Hat · Red Hat build of Quarkus
All versions: unknown
Red Hat · Red Hat Data Grid 8
All versions: unknown
Red Hat · Red Hat Fuse 7
All versions: unknown
Red Hat · Red Hat Integration Camel K 1
All versions: unknown
Red Hat · Red Hat Integration Camel Quarkus 2
All versions: unknown
Red Hat · Red Hat JBoss Data Grid 7
All versions: unknown
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack
All versions: unaffected
Red Hat · Red Hat JBoss Fuse Service Works 6
All versions: unknown
Red Hat · Red Hat Process Automation 7
All versions: unknown
Red Hat · Red Hat Single Sign-On 7
All versions: unknown
Red Hat · streams for Apache Kafka
All versions: unknown

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Mavenio.undertow:undertow-coreGHSA-6h4f-pj3g-q8fq (opens in a new tab)

What to do

Workaround: It is possible to mitigate the vulnerability by performing an upper-level verification to ensure the content size sent server side is within the allowed parameters.

References (14)

RHSA-2026:0383 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:0384 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:0386 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:3889 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:3891 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:3892 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:4915 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:4916 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:4917 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:4924 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:6011 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:6012 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-3884 (opens in a new tab)vdb-entryx_refsource_REDHAT
RHBZ#2275287 (opens in a new tab)issue-trackingx_refsource_REDHAT

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-3884](https://trackcve.app/badge/CVE-2024-3884.svg)](https://trackcve.app/cve/CVE-2024-3884)

Record last updated 5 Nov 2026, 12:26 UTC.