Описание
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap(), the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
Отчет
This CVE has been marked as Rejected by the assigning CNA.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 4 | undertow-core | Fix deferred | ||
| Red Hat build of Apache Camel - HawtIO 4 | undertow-core | Fix deferred | ||
| Red Hat Data Grid 8 | undertow-core | Fix deferred | ||
| Red Hat Enterprise Linux 10 | moditect | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-core:10.6/resteasy | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/resteasy | Fix deferred | ||
| Red Hat Enterprise Linux 9 | resteasy | Fix deferred | ||
| Red Hat Fuse 7 | undertow-core | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | undertow-core | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | org.jberet-jberet-parent | Fix deferred |
Показывать по
Дополнительная информация
Связанные уязвимости
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests