Undertow Remote Denial-of-Service Vulnerability

A remote denial-of-service vulnerability has been identified in Undertow. The issue arises in the FormEncodedDataDefinition.doParse(StreamSourceChannel) method when parsing large form data encoded as application/x-www-form-urlencoded. This processing can lead to an OutOfMemory error, allowing unauthorized users to cause a remote denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the server to run out of memory and potentially crash or become unresponsive.

Remediation

To mitigate this vulnerability, implement an upper-level verification to ensure that the size of the content sent to the server is within acceptable limits.