A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it&#
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Fuse 7.12.1 | unspecified |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1.0 | unspecified |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | 0:2.2.25-3.SP3_redhat_00001.1.el8eap |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | 0:2.2.25-3.SP3_redhat_00001.1.el9eap |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | 0:2.2.25-3.SP3_redhat_00001.1.el7eap |
| Red Hat | Red Hat Single Sign | On 7.6.5 — unspecified |
| Red Hat | Red Hat Single Sign | On 7.6 for RHEL 7 — 0:18.0.9-1.redhat_00001.1.el7sso |
| Red Hat | Red Hat Single Sign | On 7.6 for RHEL 8 — 0:18.0.9-1.redhat_00001.1.el8sso |
| Red Hat | Red Hat Single Sign | On 7.6 for RHEL 9 — 0:18.0.9-1.redhat_00001.1.el9sso |
| Red Hat | RHEL | 8 based Middleware Containers — 7.6-27 |
| Red Hat | Red Hat build of Quarkus | unspecified |
| Red Hat | Red Hat Data Grid 8 | unspecified |
| Red Hat | Red Hat Decision Manager 7 | unspecified |
| Red Hat | Red Hat Integration Camel K | unspecified |
| Red Hat | Red Hat Integration Service Registry | unspecified |
| Red Hat | Red Hat JBoss Data Grid 7 | unspecified |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | unspecified |
| Red Hat | Red Hat JBoss Fuse 6 | unspecified |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) Operational Tools | unspecified |
| Red Hat | Red Hat Process Automation 7 | unspecified |
| Red Hat | Red Hat support for Spring Boot | unspecified |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.