Описание
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | rejected CVE |
| esm-apps-legacy/xenial | not-affected | rejected CVE |
| esm-apps/bionic | not-affected | rejected CVE |
| esm-apps/focal | not-affected | rejected CVE |
| esm-apps/jammy | not-affected | rejected CVE |
| esm-apps/noble | not-affected | rejected CVE |
| esm-apps/resolute | not-affected | rejected CVE |
| esm-apps/xenial | ignored | end of ESM support, was not-affected (rejected CVE |
| jammy | not-affected | rejected CVE |
| noble | not-affected | rejected CVE |
Показывать по
Связанные уязвимости
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like `getParameterMap()`, the server prematurely parses and stores this content to disk. This could lead to resource exhaustion, potentially resulting in a Denial of Service (DoS).
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests