Undertow Out-of-Memory Error Vulnerability Leading to Remote Denial-of-Service

A denial-of-service vulnerability has been identified in Undertow. When servlets use a method that calls HttpServletRequestImpl.getParameterNames(), large parameter names from clients can trigger an OutOfMemoryError. This flaw allows unauthorized users to cause remote denial-of-service attacks by sending requests with oversized parameter names, leading to excessive memory consumption and potential application crashes.

Impact

Exploitation of this vulnerability causes a remote denial-of-service condition, where the application runs out of memory and can crash or become unresponsive. Additionally, according to Red Hat, this vulnerability could allow an attacker to read memory or files, modify memory, or execute unauthorized code or commands.