CVE-2024-4027: Undertow Core Remote DoS Vulnerability via Large Parameter Names
Summary
CVE-2024-4027: Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names. Affects io.undertow:undertow-core versions < 2.3.21.Final. Fixed in 2.3.21.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server and servlet container for Java applications. It supports both blocking and non-blocking APIs, making it suitable for a wide range of applications. However, it has a vulnerability that can lead to a denial-of-service (DoS) attack when servlets process requests with excessively large parameter names.
Vulnerability Detail
A flaw was identified in Undertow where servlets that utilize the method HttpServletRequestImpl.getParameterNames() can trigger an OutOfMemoryError when a client sends requests containing large parameter names. This vulnerability can be exploited by unauthorized users to launch remote denial-of-service attacks, potentially causing the server to become unresponsive and affecting the availability of the application.
How To Fix
Latest published version: 2.4.4.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.21.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the length of parameter names in incoming requests. This can be done by checking the length of parameter names before processing them in your servlet code.
Conclusion
The vulnerability CVE-2024-4027 in Undertow poses a significant risk of remote denial-of-service attacks due to the handling of large parameter names. It is crucial to update to the patched version or implement workarounds to mitigate this risk.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
CVE-2024-4027 is a vulnerability in the Undertow web server that allows for remote denial-of-service attacks via large parameter names.
An attacker can exploit this vulnerability by sending HTTP requests with excessively large parameter names, leading to an OutOfMemoryError on the server.
The primary consequence is a denial-of-service condition, where the server may become unresponsive, affecting the availability of the application.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
