CVE-2024-4027

Published: Jan 30, 2026Modified: Aug 5, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (5)

https://access.redhat.com/security/cve/CVE-2024-4027

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2276410

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2024-4027

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2276410

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-4027.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.