CVE-2024-3884

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

HIGH

7.5

CVSS Score

Published: December 3, 2025 at 06:40 PM UTC

Updated: October 14, 2026 at 06:17 PM UTC

19 products affected across 1 vendorJBoss Enterprise Application PlatformSingle Sign onBuild of Keycloak

Using OpenShift Serverless by Red Hat?

Get instant alerts when new vulnerabilities affect OpenShift Serverless - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

JBoss Enterprise Application Platform · Red Hatrpm

93%

All versions7

Vendor states this is fixed in 0:1.0.0-3.redhat_00009.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.0.0-3.redhat_00009.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.0.1-3.redhat_00003.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.0.1-3.redhat_00003.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.4.18-19.SP17_redhat_00001.1.ep7.el7 (unaffected)

Vendor states this is fixed in 0:1.82.0-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.82.0-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:1.83.0-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:1.83.0-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.0.2-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.0.2-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.0.41-7.SP8_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.2.39-1.Final_redhat_00001.1.el7eap (unaffected)

Vendor states this is fixed in 0:2.2.39-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.2.39-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.3.20-2.SP4_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.3.20-2.SP4_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.3.23-1.SP3_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.3.23-1.SP3_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.5.0-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.5.0-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:2.6.6-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:2.6.6-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:33.0.0-2.jre_redhat_00003.1.el8eap (unaffected)

Vendor states this is fixed in 0:33.0.0-2.jre_redhat_00003.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.0.10-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:4.0.10-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.0.2-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:4.0.2-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:4.0.6-1.redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:4.0.6-1.redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:5.0.12-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:5.0.12-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:6.6.36-1.Final_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:6.6.36-1.Final_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 0:7.1.14-4.GA_redhat_00003.1.ep7.el7 (unaffected)

Vendor states this is fixed in 0:7.3.17-5.GA_redhat_00006.1.el7eap (unaffected)

Vendor states this is fixed in 0:7.4.24-4.GA_redhat_00002.1.el7eap (unaffected)

Vendor states this is fixed in 0:7.4.24-4.GA_redhat_00002.1.el8eap (unaffected)

Vendor states this is fixed in 0:7.4.24-4.GA_redhat_00002.1.el9eap (unaffected)

Vendor states this is fixed in 0:8.1.1-4.GA_redhat_00007.1.el8eap (unaffected)

Vendor states this is fixed in 0:8.1.1-4.GA_redhat_00007.1.el9eap (unaffected)

Vendor states this is fixed in 0:8.1.3-4.GA_redhat_00006.1.el8eap (unaffected)

Vendor states this is fixed in 0:8.1.3-4.GA_redhat_00006.1.el9eap (unaffected)

Vendor states this is fixed in 0:801.3.0-1.GA_redhat_00001.1.el8eap (unaffected)

Vendor states this is fixed in 0:801.3.0-1.GA_redhat_00001.1.el9eap (unaffected)

Vendor states this is fixed in 2.2.39.Final-redhat-00001 (unaffected)

Vendor states this is fixed in 2.2.39.Final-redhat-1 (unaffected)

Vendor states this is fixed in 2.3.24.SP2-redhat-1 (unaffected)

Vendor states this is fixed in 8.0 (unaffected)

A Mq Streams · Red Hatrpm

90%

All versions

Vendor states this is fixed in 1 (unknown)

Build of Apache Camel for Quarkus · Red Hatrpm

90%

All versions

Vendor states this is fixed in 3 (unknown)

Apache Camel for Spring Boot · Red Hatrpm

90%

All versions

Vendor states this is fixed in 3 (unknown)

Vendor states this is fixed in 4 (unknown)

Build of Apache Camel - HawtIO · Red Hatrpm

90%

All versions

Vendor states this is fixed in 4 (unknown)

Build of Apicurio Registry · Red Hatrpm

90%

All versions

Vendor states this is fixed in 2 (unknown)

Build of Keycloak · Red Hatcontainer

90%

All versions

Build of Optaplanner · Red Hatrpm

90%

All versions

Vendor states this is fixed in 8 (unknown)

Build of Quarkus · Red Hatrpm

90%

All versions

Vendor states this is fixed in 2 (unknown)

Data Grid · Red Hatrpm

90%

All versions

Vendor states this is fixed in 8 (unknown)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (19)

VDB Entryx_refsource_REDHAT

Source: cverecord

https://access.redhat.com/security/cve/CVE-2024-3884

Issue Trackingx_refsource_REDHAT

Source: cverecord

https://bugzilla.redhat.com/show_bug.cgi?id=2275287

Source: cverecord

https://access.redhat.com/errata/RHSA-2025:22777

Source: cverecord

https://access.redhat.com/errata/RHSA-2025:22773

Source: cverecord

https://access.redhat.com/errata/RHSA-2025:22775

Source: cverecord

https://access.redhat.com/errata/RHSA-2025:3990

Source: cverecord

https://access.redhat.com/errata/RHSA-2025:3992

Vendor Advisoryx_refsource_REDHAT

Source: cverecord

https://access.redhat.com/errata/RHSA-2026:0383

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card