CVE-2024-4027
Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
- Record
CVE-2024-4027- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-20
- Updated
- 2026-11-04
EUVDEUVD-2024-32593
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
- Record
EUVD-2024-32593- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-33hj-rcmx-86mv
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
- Record
GHSA-33hj-rcmx-86mv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
- Record
CVE-2024-4027- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2024-4027
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
- Record
DEBIAN-CVE-2024-4027- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVGHSA-33hj-rcmx-86mv
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
- Record
GHSA-33hj-rcmx-86mv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 11 moreShow less
OSVOESA-2026-1386
undertow security update
Java web server using non-blocking IO
Security Fix(es):
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.(CVE-2024-3884)
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.(CVE-2024-4027)
- Record
OESA-2026-1386- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1387
undertow security update
Java web server using non-blocking IO
Security Fix(es):
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.(CVE-2024-3884)
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.(CVE-2024-4027)
- Record
OESA-2026-1387- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1388
undertow security update
Java web server using non-blocking IO
Security Fix(es):
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.(CVE-2024-3884)
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.(CVE-2024-4027)
- Record
OESA-2026-1388- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1389
undertow security update
Java web server using non-blocking IO
Security Fix(es):
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.(CVE-2024-3884)
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.(CVE-2024-4027)
- Record
OESA-2026-1389- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1390
undertow security update
Java web server using non-blocking IO
Security Fix(es):
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.(CVE-2024-3884)
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.(CVE-2024-4027)
- Record
OESA-2026-1390- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1431
undertow security update
Java web server using non-blocking IO
Security Fix(es):
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.(CVE-2024-3884)
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.(CVE-2024-4027)
- Record
OESA-2026-1431- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-4027
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.
- Record
UBUNTU-CVE-2024-4027- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776126822 No score
TuxCare security update for io.undertow:undertow-core (3 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 3 CVEs. Fixed in 2.3.18.Final-tuxcare.1.
- Record
CLSA-2026-1776126822- Updated
- 2026-11-02
OSVCLSA-2026-1778546708 No score
TuxCare security update for io.undertow:undertow-core (1 CVE)
TuxCare rebuilt io.undertow:undertow-core to address 1 CVE. Fixed in 2.3.10.Final-tuxcare.5.
- Record
CLSA-2026-1778546708- Updated
- 2026-11-02
OSVCLSA-2026-1784769562 No score
TuxCare security update for io.undertow:undertow-core (1 CVE)
TuxCare rebuilt io.undertow:undertow-core to address 1 CVE. Fixed in 2.3.20.Final-tuxcare.1.
- Record
CLSA-2026-1784769562- Updated
- 2026-11-02
OSVCLSA-2026-1786429714 No score
TuxCare security update for io.undertow:undertow-core (3 CVEs)
TuxCare rebuilt io.undertow:undertow-core to address 3 CVEs. Fixed in 2.3.17.Final-tuxcare.1.
- Record
CLSA-2026-1786429714- Updated
- 2026-11-02
Affected products
- red hat build of apicurio registry 2
- red hat build of quarkus
- red hat data grid 8
- red hat fuse 7
- red hat integration camel k 1
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat process automation 7
- red hat single sign-on 7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.undertow:undertow-coreMaven |
before 2.2.39.Final | 2.2.39.Final |
io.undertow:undertow-coreMaven |
2.4.0.Alpha1 to 2.4.0.Alpha1 | 2.4.0.Beta1 |
io.undertow:undertow-coreMaven |
2.3.0.Alpha1 up to 2.3.21.Final | 2.3.21.Final |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.3.18.Final up to 2.3.18.Final-tuxcare.1 | 2.3.18.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven |
2.3.10.Final up to 2.3.10.Final-tuxcare.5, plus listed versions 2.3.10.Final-tuxcare.12.3.10.Final-tuxcare.22.3.10.Final-tuxcare.32.3.10.Final-tuxcare.4 |
2.3.10.Final-tuxcare.5 |
io.undertow:undertow-coreTuxCare:Maven |
2.3.20.Final up to 2.3.20.Final-tuxcare.1 | 2.3.20.Final-tuxcare.1 |
io.undertow:undertow-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.3.17.Final up to 2.3.17.Final-tuxcare.1 | 2.3.17.Final-tuxcare.1 |
undertowDebian:14 |
All versions, plus listed versions 1.3.11-11.3.16-11.3.19-11.3.21-11.3.23-1 Show 45 moreShow less1.3.4-11.3.5-11.3.7-11.4.0-11.4.1-11.4.18-11.4.20-11.4.21-11.4.21-21.4.22-11.4.23-11.4.23-21.4.23-31.4.25-11.4.25-21.4.3-11.4.4-11.4.6-11.4.7-11.4.8-12.0.23-12.0.25-12.0.26-12.0.27-12.0.28-12.0.29-12.0.30-12.1.0-12.1.1-12.1.3-12.2.0-12.2.10-12.2.12-12.2.13-12.2.14-12.2.16-12.2.17-12.2.18-12.2.19-12.2.2-12.2.20-12.2.21-12.2.3-12.2.4-12.2.5-1 |
None known |
io.undertow:undertow-coreMaven |
before 2.2.39.Final, plus listed versions 1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13 Show 45 moreShow less1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha201.0.0.Alpha211.0.0.Alpha221.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta101.0.0.Beta111.0.0.Beta121.0.0.Beta131.0.0.Beta141.0.0.Beta151.0.0.Beta161.0.0.Beta171.0.0.Beta181.0.0.Beta191.0.0.Beta21.0.0.Beta201.0.0.Beta211.0.0.Beta221.0.0.Beta231.0.0.Beta241.0.0.Beta251.0.0.Beta261.0.0.Beta271.0.0.Beta281.0.0.Beta291.0.0.Beta31.0.0.Beta301.0.0.Beta311.0.0.Beta321.0.0.Beta331.0.0.Beta4 |
2.2.39.Final |
io.undertow:undertow-coreMaven |
2.4.0.Alpha1 up to 2.4.0.Beta1 | 2.4.0.Beta1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.undertow:undertow-coreMaven |
2.3.0.Alpha1 up to 2.3.21.Final, plus listed versions 2.3.0.Alpha22.3.0.Beta12.3.0.Final2.3.1.Final2.3.10.Final Show 18 moreShow less2.3.11.Final2.3.12.Final2.3.13.Final2.3.14.Final2.3.15.Final2.3.16.Final2.3.17.Final2.3.18.Final2.3.19.Final2.3.2.Final2.3.20.Final2.3.3.Final2.3.4.Final2.3.5.Final2.3.6.Final2.3.7.Final2.3.8.Final2.3.9.Final |
2.3.21.Final |
undertowopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.4.0-10.oe2203sp4 | 1.4.0-10.oe2203sp4 |
undertowopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 1.4.0-11.oe2403 | 1.4.0-11.oe2403 |
undertowopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.4.0-11.oe2403sp1 | 1.4.0-11.oe2403sp1 |
undertowopenEuler:24.03-LTS-SP2 From an advisory covering 2 CVEs |
before 1.4.0-11.oe2403sp2 | 1.4.0-11.oe2403sp2 |
undertowopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.4.0-11.oe2403sp3 | 1.4.0-11.oe2403sp3 |
undertowopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.4.0-10.oe2003sp4 | 1.4.0-10.oe2003sp4 |
undertowUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.4-11.3.5-11.3.7-11.3.11-11.3.16-11.3.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4.20-11.4.21-11.4.22-11.4.23-11.4.23-2build11.4.23-31.4.23-3ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.23-12.0.27-12.0.28-12.0.29-12.0.29-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.2.8-12.2.12-12.2.13-12.2.14-12.2.16-12.2.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.8-22.3.8-2ubuntu0.1~esm1 |
None known |
undertowUbuntu:25.10 |
All versions, plus listed versions 2.3.18-12.3.18-2 |
None known |
undertowUbuntu:26.10 |
All versions, plus listed versions 2.3.20-1ubuntu1 |
None known |
undertowUbuntu:26.04:LTS |
All versions, plus listed versions 2.3.18-22.3.20-12.3.20-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-4027 is a high vulnerability (CVSS 7.5) in Red Hat Build Of Apicurio Registry 2, published January 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in io.undertow:undertow-core 2.2.39.Final.
References
access.redhat.com/security/cve/CVE-2024-4027
bugzilla.redhat.com/show_bug.cgi?id=2276410
security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-4027.json
nvd.nist.gov/vuln/detail/CVE-2024-4027
github.com/undertow-io/undertow/commit/6b7c18481ce65ae4012d92fe2b7f17a21ef4d70b
Show 21 moreShow less
issues.redhat.com/browse/UNDERTOW-2377
security-tracker.debian.org/tracker/CVE-2024-4027
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1386
ubuntu.com/security/CVE-2024-4027
cve.org/CVERecord?id=CVE-2024-4027
Left out here: 263 versions. The JSON record has them.