Undertow: unrestricted request storage leads to memory exhaustion
Priority MEDIUM 41CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01284 70th percentileScored 2026-11-07
Fix Fixed io.undertow:undertow-core (Maven): 2.2.32.Final, 2.3.13.FinalRed Hat: 8 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.30-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.30-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.30-1.SP1_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.3.11-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.3.11-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| — | io.undertow:undertow-core (Maven) | before 2.2.32.Final | 2.2.32.Final | Patch available | GHSA-97cq-f4jm-mv8h |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Alpha1 to before 2.3.13.Final | 2.3.13.Final | Patch available | GHSA-97cq-f4jm-mv8h |
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.3.11-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.3.11-1.SP1_redhat_00001.1.el9eap Patch available CNA
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.32.Final Fixed in 2.2.32.Final Patch available GHSA-97cq-f4jm-mv8h
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Alpha1 to before 2.3.13.Final Fixed in 2.3.13.Final Patch available GHSA-97cq-f4jm-mv8h
CPE names CNA · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 | 8.0 | — | Red Hat |
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 Versions 8.0 — ·Red Hat
Remediation
- Fix · GHSA-97cq-f4jm-mv8h io.undertow:undertow-core (Maven) Fixed in 2.2.32.Final Advisory →
- Fix · GHSA-97cq-f4jm-mv8h io.undertow:undertow-core (Maven) Fixed in 2.3.13.Final Advisory →
Red Hat 8 advisories
- RHSA-2025:9583 Released 2025-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.14 Security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40
- RHSA-2025:4226 Released 2025-04-28 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
- RHSA-2024:2764 Released 2024-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el8eap
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el9eap
Show 5 more Red Hat advisories
- RHSA-2024:2763 Released 2024-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss Enterprise Application Platform 8
- RHSA-2024:1674 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el7eap +47
- RHSA-2024:1675 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el8eap +47
- RHSA-2024:1676 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el9eap +47
- RHSA-2024:1677 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss Enterprise Application Platform 7.4.16 io.undertow.undertow-core-2.2.30.SP1-redhat-00001.jar, org.apache.sshd.sshd-common-2.12.1.redhat-00001.jar, org.jberet.jberet-core-1.3.9.SP3-redhat-00001.jar
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:1674 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:1675 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:1676 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2024:2764 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2024:2764 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:4226 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:9583 |
| Red Hat JBoss Enterprise Application Platform 7.4.16 | Fixed | RHSA-2024:1677 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:2763 |
Not affected: 4 products
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7.4.16
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1973
- 2026-10-03 Alias added: GHSA-97cq-f4jm-mv8h
- 2026-10-08 Fix available: Red Hat JBoss Enterprise Application Platform 7.4.16 · Red Hat
References
Advisory 7
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-1973 · CVE Program
- CVE-2023-1973 · NVD
- FIRST EPSS
- GHSA-97cq-f4jm-mv8h · GitHub Advisory Database · CC BY 4.0
- CVE-2023-1973 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences