Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks

Summary

CVE	CVE-2024-4027
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-01-30 15:16:07 UTC
Updated	2026-07-15 02:17:09 UTC
Description	A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.005750000 probability, percentile 0.435990000 (date 2026-07-18)

Problem Types: CWE-20 | CWE-20 Improper Input Validation

Version	Source	Type	Score	Severity	Vector
3.1	ADP	CVSS	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	CVSS	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	OpenShift Serverless	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apache Camel 4 For Quarkus 3	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apache Camel For Spring Boot 3	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apache Camel For Spring Boot 4	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apache Camel - HawtIO 4	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apicurio Registry 2	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Keycloak	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of OptaPlanner 8	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Quarkus	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Quarkus	Not specified	Not specified
CNA	Red Hat	Red Hat Data Grid 8	Not specified	Not specified
CNA	Red Hat	Red Hat Fuse 7	Not specified	Not specified
CNA	Red Hat	Red Hat Integration Camel K 1	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Data Grid 7	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Enterprise Application Platform 7	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Enterprise Application Platform 8	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Fuse Service Works 6	Not specified	Not specified
CNA	Red Hat	Red Hat Process Automation 7	Not specified	Not specified
CNA	Red Hat	Red Hat Single Sign-On 7	Not specified	Not specified
CNA	Red Hat	Streams For Apache Kafka	Not specified	Not specified
ADP	Red Hat	OpenShift Serverless	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Apache Camel 4 For Quarkus 3	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Apache Camel For Spring Boot 3	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Apache Camel For Spring Boot 4	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Apache Camel - HawtIO 4	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Apicurio Registry 2	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Keycloak	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of OptaPlanner 8	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Quarkus	Not specified	Not specified
ADP	Red Hat	Red Hat Data Grid 8	Not specified	Not specified
ADP	Red Hat	Red Hat Fuse 7	Not specified	Not specified
ADP	Red Hat	Red Hat Integration Camel K 1	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Data Grid 7	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform 7	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform 8	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Fuse Service Works 6	Not specified	Not specified
ADP	Red Hat	Red Hat Process Automation 7	Not specified	Not specified
ADP	Red Hat	Red Hat Single Sign-On 7	Not specified	Not specified
ADP	Red Hat	Streams For Apache Kafka	Not specified	Not specified

References

Reference	Source	Link	Tags
security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-4027.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
access.redhat.com/security/cve/CVE-2024-4027	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Source	Time	Event
CNA	2024-04-22T00:00:00.000Z	Reported to Red Hat.
CNA	2026-01-30T14:00:00.000Z	Made public.
ADP	2024-04-22T00:00:00.000Z	Reported to Red Hat.
ADP	2026-01-30T14:00:00.000Z	Made public.

Workarounds

CNA: Currently no mitigation is available for this vulnerability. Please make sure to perform the update as they become available.

ADP: Currently no mitigation is available for this vulnerability. Please make sure to perform the update as they become available.

There are currently no legacy QID mappings associated with this CVE.