« Volver al listado

CVE-2024-3884

Estado: AplazadaAlta (7.5)—

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). Descripción explícita de DoS remoto por agotamiento de memoria al parsear datos de formulario grandes (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Redhat — UndertowAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-3884",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-3884",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-03T20:50:16.644717Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.4.18-19.SP17_redhat_00001.1.ep7.el7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.1.14-4.GA_redhat_00003.1.ep7.el7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.0.41-7.SP8_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.3.17-5.GA_redhat_00006.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4.24",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.2.39.Final-redhat-00001",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "io.undertow/undertow-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.2.39-1.Final_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.4.24-4.GA_redhat_00002.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.2.39-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.4.24-4.GA_redhat_00002.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.2.39-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.4.24-4.GA_redhat_00002.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.83.0-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-bouncycastle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:33.0.0-2.jre_redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-guava-libraries",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.0.6-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jaxb",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.0.0-3.redhat_00009.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jcip-annotations",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.0.2-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-slf4j-jboss-logmanager",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.3.23-1.SP3_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.83.0-1.redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-bouncycastle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:33.0.0-2.jre_redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-guava-libraries",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.0.6-1.redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jaxb",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.0.0-3.redhat_00009.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jcip-annotations",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.0.2-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-slf4j-jboss-logmanager",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.3.23-1.SP3_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1.6",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.3.24.SP2-redhat-00001",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "io.undertow/undertow-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.0.10-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-apache-cxf",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.82.0-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-bouncycastle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:801.3.0-1.GA_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-eap-product-conf-parent",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.0.1-3.redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-eventstream",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:6.6.36-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-hibernate",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.0.2-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jboss-el-api_5.0_spec",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.0-1.redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jboss-threads",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.3.20-2.SP4_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:8.1.3-4.GA_redhat_00006.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.0.12-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly-clustering",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.6.6-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly-elytron",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:8.1.1-4.GA_redhat_00007.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly-javadocs",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.0.10-1.redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-apache-cxf",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.82.0-1.redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-bouncycastle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:801.3.0-1.GA_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-eap-product-conf-parent",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.0.1-3.redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-eventstream",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:6.6.36-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-hibernate",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.0.2-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jboss-el-api_5.0_spec",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.0-1.redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-jboss-threads",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.3.20-2.SP4_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:8.1.3-4.GA_redhat_00006.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.0.12-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly-clustering",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.6.6-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly-elytron",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:8.1.1-4.GA_redhat_00007.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-wildfly-javadocs",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Serverless",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:camel_spring_boot:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel for Spring Boot 3",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:camel_spring_boot:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel for Spring Boot 4",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_registry:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Apicurio Registry 2",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:optaplanner:::el6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of OptaPlanner 8",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:quarkus:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Quarkus",
          "packageName": "quarkus-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:quarkus:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Quarkus",
          "packageName": "quarkus-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_data_grid:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Data Grid 8",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Fuse 7",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:integration:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Integration Camel K 1",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Integration Camel Quarkus 2",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_data_grid:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Data Grid 7",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_fuse_service_works:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Fuse Service Works 6",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Process Automation 7",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Single Sign-On 7",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:amq_streams:1"
          ],
          "vendor": "Red Hat",
          "product": "streams for Apache Kafka",
          "packageName": "undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-12-03T19:15:54.767",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0383",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0384",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:0386",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:3889",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:3891",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:3892",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:4915",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:4916",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:4917",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:4924",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:6011",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:6012",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-3884",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2275287",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en Undertow que puede causar ataques remotos de denegación de servicio. Cuando el servidor utiliza el método FormEncodedDataDefinition.doParse(StreamSourceChannel) para analizar grandes datos de formulario codificados con application/x-www-form-urlencoded, el método causará un problema de OutOfMemory. Esta vulnerabilidad permite a usuarios no autorizados causar un ataque remoto de denegación de servicio (DoS)."
    }
  ],
  "lastModified": "2026-09-26T21:10:00.130",
  "sourceIdentifier": "secalert@redhat.com"
}