Read the docs
TI-2023-03019 Aliases CVE-2023-3223GHSA-65h2-wf7m-q2v8

Undertow: outofmemoryerror due to @multipartconfig handling

Priority MEDIUM 44CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 13 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.

Summary

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02659 85th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-parent (Maven): 2.2.24.FinalRed Hat: 13 advisoriesRed Hat: 13 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Fuse 7.12.1——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1.0——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 8—2.2.25-3.SP3_redhat_00001.1.el8eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 9—2.2.25-3.SP3_redhat_00001.1.el9eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 7—2.2.25-3.SP3_redhat_00001.1.el7eapPatch availableCNA
Red HatRed Hat Single Sign-On 7.6.5——Not affectedCNA
Red HatRed Hat Single Sign-On 7.6 for RHEL 7—18.0.9-1.redhat_00001.1.el7ssoPatch availableCNA
Red HatRed Hat Single Sign-On 7.6 for RHEL 8—18.0.9-1.redhat_00001.1.el8ssoPatch availableCNA
Red HatRed Hat Single Sign-On 7.6 for RHEL 9—18.0.9-1.redhat_00001.1.el9ssoPatch availableCNA
Red HatRHEL-8 based Middleware Containers—7.6-27Patch availableCNA
Red HatRed Hat build of Quarkus——Not affectedCNA
Red HatRed Hat Data Grid 8——Not affectedCNA
Red HatRed Hat Decision Manager 7——No fix listedCNA
Red HatRed Hat Integration Camel K——No fix listedCNA
Red HatRed Hat Integration Service Registry——No fix listedCNA
Red HatRed Hat JBoss Data Grid 7——No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——Not affectedCNA
Red HatRed Hat JBoss Fuse 6——No fix listedCNA
Red HatRed Hat OpenStack Platform 13 (Queens) Operational Tools——No fix listedCNA
Red HatRed Hat Process Automation 7——No fix listedCNA
Red HatRed Hat support for Spring Boot——Not affectedCNA
—io.undertow:undertow-parent (Maven)before 2.2.24.Final2.2.24.FinalPatch availableGHSA-65h2-wf7m-q2v8
  • Red Hat Fuse 7.12.1 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform 7.1.0 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.25-3.SP3_redhat_00001.1.el8eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.25-3.SP3_redhat_00001.1.el9eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.25-3.SP3_redhat_00001.1.el7eap Patch available CNA
  • Red Hat Single Sign-On 7.6.5 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Single Sign-On 7.6 for RHEL 7 VendorRed Hat Affected — Fixed in 18.0.9-1.redhat_00001.1.el7sso Patch available CNA
  • Red Hat Single Sign-On 7.6 for RHEL 8 VendorRed Hat Affected — Fixed in 18.0.9-1.redhat_00001.1.el8sso Patch available CNA
  • Red Hat Single Sign-On 7.6 for RHEL 9 VendorRed Hat Affected — Fixed in 18.0.9-1.redhat_00001.1.el9sso Patch available CNA
  • RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.6-27 Patch available CNA
  • Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Decision Manager 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Integration Camel K VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Integration Service Registry VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenStack Platform 13 (Queens) Operational Tools VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat support for Spring Boot VendorRed Hat Affected — Fixed in — Not affected CNA
  • io.undertow:undertow-parent (Maven) Vendor— Affected before 2.2.24.Final Fixed in 2.2.24.Final Patch available GHSA-65h2-wf7m-q2v8

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.2.24VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*4.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*4.12VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9:*:*:*:*:*:*:*4.9VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*4.9VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform_text-only_advisories:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.2.24 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform_text-only_advisories:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
  • cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-65h2-wf7m-q2v8 io.undertow:undertow-parent (Maven) Fixed in 2.2.24.Final Advisory →

Red Hat 13 advisories

  • RHSA-2025:9583 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.14 Security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40
  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2024:3354 Released 2024-05-23 · Red Hat rating Important
    Red Hat Fuse 7.13.0 release and security update
    • Red Hat Fuse 7.13.0
Show 10 more Red Hat advisories
  • RHSA-2023:7247 Released 2023-11-15 · Red Hat rating Critical
    Red Hat Fuse 7.12.1 release and security update
    • Red Hat Fuse 7.12.1
  • RHSA-2023:4924 Released 2023-08-31 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.5 security update
    • Red Hat Single Sign-On 7.6.5
  • RHSA-2023:4918 Released 2023-08-31 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.5 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.9-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.9-1.redhat_00001.1.el7sso
  • RHSA-2023:4920 Released 2023-08-31 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.5 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.9-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.9-1.redhat_00001.1.el9sso
  • RHSA-2023:4919 Released 2023-08-31 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.5 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.9-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.9-1.redhat_00001.1.el8sso
  • RHSA-2023:4921 Released 2023-08-31 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.5 for OpenShift image enhancement and security update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:4507 Released 2023-08-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jettison-1.5.4-1.redhat_00002.1.el9eap, eap7-undertow-2.2.25-3.SP3_redhat_00001.1.el9eap, eap7-wildfly-7.4.12-3.GA_redhat_00003.1.el9eap +5
  • RHSA-2023:4506 Released 2023-08-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jettison-1.5.4-1.redhat_00002.1.el8eap, eap7-undertow-2.2.25-3.SP3_redhat_00001.1.el8eap, eap7-wildfly-7.4.12-3.GA_redhat_00003.1.el8eap +5
  • RHSA-2023:4505 Released 2023-08-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jettison-1.5.4-1.redhat_00002.1.el7eap, eap7-undertow-2.2.25-3.SP3_redhat_00001.1.el7eap, eap7-wildfly-7.4.12-3.GA_redhat_00003.1.el7eap +4
  • RHSA-2023:4509 Released 2023-08-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.12 security update
    • Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, io.undertow.undertow-core-2.2.25.SP3-redhat-00001.jar, org.codehaus.jettison.jettison-1.5.4.redhat-00002.jar

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix yet
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens) Operational ToolsAffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Middleware Containers for OpenShiftFixed RHSA-2023:4921
Red Hat Fuse 7.12.1Fixed RHSA-2023:7247
Red Hat Fuse 7.13.0Fixed RHSA-2024:3354
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:4505
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:4506
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:4507
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2023:4509
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:9583
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:4918
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:4919
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:4920
Red Hat Single Sign-On 7.6.5Fixed RHSA-2023:4924
Not affected: 8 products
  • Red Hat Data Grid 8
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Quarkus
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3223
  2. 2026-10-03 Alias added: GHSA-65h2-wf7m-q2v8

References

Advisory 13

Other 3

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences