VDB

CVE-2024-3884

CVE-2024-3884 PUBLISHED CVSS 7.5 HIGH

Reported by redhat · Published December 3, 2025

undertow-core is fixed in 2.4.0.Beta1, 2.4.0.Alpha1, 2.3.21.Final and 1 more (Maven Central)

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
io.undertow:undertow-coreMaven Central2.4.0.Beta1, 2.4.0.Alpha1, 2.3.21.Final, 2.2.39.Final
wildflyWolfi39.0.0-r0
wildflyChainguard39.0.0-r0

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 70:1.4.18-19.SP17_redhat_00001.1.ep7.el7
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 70:7.1.14-4.GA_redhat_00003.1.ep7.el7
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 70:2.0.41-7.SP8_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 70:7.3.17-5.GA_redhat_00006.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4.242.2.39.Final-redhat-00001
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.2.39-1.Final_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:7.4.24-4.GA_redhat_00002.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 80:2.2.39-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 80:7.4.24-4.GA_redhat_00002.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 90:2.2.39-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 90:7.4.24-4.GA_redhat_00002.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 80:1.83.0-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 80:33.0.0-2.jre_redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 80:4.0.6-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 80:1.0.0-3.redhat_00009.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 80:2.0.2-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 80:2.3.23-1.SP3_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 90:1.83.0-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 90:33.0.0-2.jre_redhat_00003.1.el9eap

…and 127 more

Timeline

  • Dec 3, 2025 CVE Published
  • Dec 3, 2025 PoC Published
  • Dec 4, 2025 EPSS Score (30 in total, the first dated here)
  • Mar 17, 2026 Distribution Patch (20 in total, the first dated here)
  • Mar 17, 2026 Security Advisory (21 in total, the first dated here)
  • Jul 10, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2024-3884
vulnetix vdb fixes CVE-2024-3884

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-3884/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 10 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›