Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names

🗓️ 30 Jan 2026 15:31:14Reported by GitHub Advisory DatabaseType

Undertow servlet flaw enables remote denial of service by large parameter names causing OutOfMemoryError.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow web server	10 Apr 202613:38	–	ibm
Circl	CVE-2024-4027	31 Jan 202603:27	–	circl
CNNVD	Undertow input validation error vulnerability	30 Jan 202600:00	–	cnnvd
CVE	CVE-2024-4027	30 Jan 202614:25	–	cve
Cvelist	CVE-2024-4027 Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks	30 Jan 202614:25	–	cvelist
Debian CVE	CVE-2024-4027	30 Jan 202614:25	–	debiancve
EUVD	EUVD-2024-32593	30 Jan 202614:25	–	euvd
NVD	CVE-2024-4027	30 Jan 202615:16	–	nvd
OSV	DEBIAN-CVE-2024-4027	30 Jan 202615:16	–	osv
OSV	GHSA-33HJ-RCMX-86MV Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names	30 Jan 202615:31	–	osv

Vulners

Node

io.undertow undertow-coreRange2.3.0.Alpha1–2.3.21.Finalmaven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-4027
access	www.access.redhat.com/security/cve/CVE-2024-4027
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/undertow-io/undertow/commit/6b7c18481ce65ae4012d92fe2b7f17a21ef4d70b
github	www.github.com/undertow-io/undertow/releases/tag/2.3.21.Final
issues	www.issues.redhat.com/browse/UNDERTOW-2377
github	www.github.com/undertow-io/undertow/pull/1860
github	www.github.com/undertow-io/undertow/pull/1882
github	www.github.com/undertow-io/undertow/pull/1894
github	www.github.com/undertow-io/undertow/commit/8318dd36fdc2c9842baf10c5f1bfbb3bc23f75e7

25 Feb 2026 20:20Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00381

SSVC