CVE-2024-3884: Undertow OutOfMemory Vulnerability in Form Data Parsing
Summary
CVE-2024-3884: Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded. Affects io.undertow:undertow-core versions < 2.3.21.Final. Fixed in 2.3.21.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server designed for handling HTTP requests and responses in Java applications. It is widely used for its lightweight architecture and ability to support both blocking and non-blocking APIs. However, a vulnerability has been identified in the FormEncodedDataDefinition.doParse(StreamSourceChannel) method, which can lead to severe performance issues when processing large form data encoded with application/x-www-form-urlencoded.
Vulnerability Detail
A flaw exists in the Undertow package that can lead to an OutOfMemory error when the server attempts to parse large form data. This vulnerability can be exploited by unauthorized users to launch remote denial of service (DoS) attacks, potentially causing the server to crash or become unresponsive. The issue arises from the way the FormEncodedDataDefinition.doParse method handles excessive data input, leading to resource exhaustion.
How To Fix
Latest published version: 2.4.4.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.21.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to limit the size of form data being processed. This can help mitigate the risk of triggering the OutOfMemory error until the package can be updated.
Conclusion
The CVE-2024-3884 vulnerability in Undertow poses a significant risk of denial of service attacks due to OutOfMemory errors when processing large form data. It is crucial to update to the patched version 2.3.21.Final or later to mitigate this risk. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
CVE-2024-3884 is a vulnerability in the Undertow web server that can lead to OutOfMemory errors when parsing large form data.
Exploitation of this vulnerability can result in remote denial of service attacks, causing your application to crash or become unresponsive.
Versions prior to 2.3.21.Final are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Additionally, you can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
