Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow web server component

Summary Due to use of the Undertow web server component, DevOps Test Performance and Rational Performance Tester contain a potential vulnerability that can cause a denial of service DoS. CVE-2024-3884 Vulnerability Details CVEID:CVE-2024-3884 DESCRIPTION: A flaw was found in Undertow that can cau...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.14 (RHSA-2026:6012)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:6012 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Undertow

Summary Multiple vulnerabilities in Undertow that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-3884 DESCRIPTION: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:4915)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4915 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.12 (RHSA-2026:3889)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3889 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release o...

OESA-2026-1386 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

OESA-2026-1389 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

OESA-2026-1390 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

OESA-2026-1387 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.11 (RHSA-2025:22773)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22773 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release ...

com.github.zurekp:slb (0.0.5), fr.braindead:websocket-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.2.0.beta8)

io.undertow:undertow-core MAVEN version 1.2.0.beta8 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.zurekp:slb 0.0.5 - fr.braindead:websocket-client =1.0.0, =1.0.4, =0.4.0, =0.4.0, =0.4.0,...

com.thehellings.gully:gully (0.4), com.thehellings:gully (0.5) +57 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.3.0.final)

io.undertow:undertow-core MAVEN version 1.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.thehellings.gully:gully 0.4 - com.thehellings:gully 0.5 - de.svenkubiak:mangooio-hibernate-extensio...

com.qwazr:qwazr (1.4.0), com.qwazr:qwazr-cluster (1.4.0) +51 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.4.24.final)

io.undertow:undertow-core MAVEN version 1.4.24.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.qwazr:qwazr 1.4.0 - com.qwazr:qwazr-cluster 1.4.0 - com.qwazr:qwazr-compiler 1.4.0 -...

co.paralleluniverse:comsat-test-utils (0.4.0), com.gitblit.fathom:fathom-core (>=0.5.2, <=0.6.0) +92 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.2.8.final)

io.undertow:undertow-core MAVEN version 1.2.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-test-utils 0.4.0 - com.gitblit.fathom:fathom-core =0.5.2, =0.5.2, =0.5.2,...

com.networknt:audit (>=1.4.1, <=1.4.6), com.networknt:balance (>=1.4.1, <=1.4.6) +48 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.4.19.final)

io.undertow:undertow-core MAVEN version 1.4.19.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.networknt:audit =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1,...

io.undertow:undertow-servlet (1.3.31.final), io.undertow:undertow-websockets-jsr (1.3.31.final) potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.3.31.final)

io.undertow:undertow-core MAVEN version 1.3.31.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.31.final - io.undertow:undertow-websockets-jsr 1.3.31.final Source...

de.svenkubiak:mangooio-mongodb-extension (2.0.1), io.mangoo:mangooio-benchmark (2.2.0) +26 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.3.12.final)

io.undertow:undertow-core MAVEN version 1.3.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.svenkubiak:mangooio-mongodb-extension 2.0.1 - io.mangoo:mangooio-benchmark 2.2.0 -...

io.undertow:undertow-servlet (1.1.0.cr2), io.undertow:undertow-websockets-jsr (1.1.0.cr2) potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.1.0.cr2)

io.undertow:undertow-core MAVEN version 1.1.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.cr2 - io.undertow:undertow-websockets-jsr 1.1.0.cr2 Source cves:...

io.undertow:undertow-http2-test-suite (1.3.0.beta12), io.undertow:undertow-servlet (1.3.0.beta12) +1 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.3.0.beta12)

io.undertow:undertow-core MAVEN version 1.3.0.beta12 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta12 - io.undertow:undertow-servlet 1.3.0.beta12 -...

com.github.zurekp:slb (>=0.0.1, <=0.0.4), io.undertow:undertow-http2-test-suite (1.2.0.beta6) +3 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.2.0.beta6)

io.undertow:undertow-core MAVEN version 1.2.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.zurekp:slb =0.0.1, =1.0.0.alpha14, =1.0.0.alpha15 Source cves: CVE-2024-3884 Source advisory...