Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow web server

Summary Due to use of the Undertow web server, DevOps Test Performance and Rational Performance Tester contain a potential improper input validation vulnerability. CVE-2024-4027 Vulnerability Details CVEID:CVE-2024-4027 DESCRIPTION: A flaw was found in Undertow. Servlets using a method that calls...

OESA-2026-1390 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

OESA-2026-1386 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

OESA-2026-1389 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

OESA-2026-1387 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the...

Linux Distros Unpatched Vulnerability : CVE-2024-4027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames can cause an OutOfMemoryError when the client sends a...

com.github.dkubiak:goldfish-collector-maven (1.0), com.github.dkubiak:goldfish-server (1.0) +3 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.1.4.final)

io.undertow:undertow-core MAVEN version 1.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.dkubiak:goldfish-collector-maven 1.0 - com.github.dkubiak:goldfish-server 1.0 -...

io.undertow.jastow:jastow (>=1.0.0.cr1, <=1.0.0.final), io.undertow:undertow-servlet (1.0.0.beta27) +2 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.0.0.beta27)

io.undertow:undertow-core MAVEN version 1.0.0.beta27 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow.jastow:jastow =1.0.0.cr1, =1.0.0.final - io.undertow:undertow-servlet 1.0.0.beta27 -...

io.undertow:undertow-http2-test-suite (1.3.0.cr1), io.undertow:undertow-servlet (1.3.0.cr1) +49 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.3.0.cr1)

io.undertow:undertow-core MAVEN version 1.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.cr1 - io.undertow:undertow-servlet 1.3.0.cr1 -...

io.undertow:undertow-dist (1.0.0.beta15), io.undertow:undertow-servlet (1.0.0.beta15) +1 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.0.0.beta15)

io.undertow:undertow-core MAVEN version 1.0.0.beta15 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-dist 1.0.0.beta15 - io.undertow:undertow-servlet 1.0.0.beta15 -...

com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (1.1.0), io.mangoo:mangooio-core (>=1.3.0, <=1.3.2) +101 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.3.3.final)

io.undertow:undertow-core MAVEN version 1.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service 1.1.0 - io.mangoo:mangooio-core =1.3.0...

io.undertow:undertow-servlet (1.3.33.final), io.undertow:undertow-websockets-jsr (1.3.33.final) +10 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.3.33.final)

io.undertow:undertow-core MAVEN version 1.3.33.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.33.final - io.undertow:undertow-websockets-jsr 1.3.33.final -...

co.paralleluniverse:comsat-test-utils (0.2.0), io.undertow:undertow-servlet (1.1.0.beta5) +2 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.1.0.beta5)

io.undertow:undertow-core MAVEN version 1.1.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-test-utils 0.2.0 - io.undertow:undertow-servlet 1.1.0.beta5 -...

com.sksamuel.scruffy:scruffy-integrationtest_2.11 (1.12.0), com.sksamuel.scruffy:scruffy-undertow_2.11 (>=1.9.0, <=1.12.0) +39 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.2.0.beta10)

io.undertow:undertow-core MAVEN version 1.2.0.beta10 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.sksamuel.scruffy:scruffy-integrationtest2.11 1.12.0 - com.sksamuel.scruffy:scruffy-undertow2.11...

com.github.wuic:wuic-test (>=0.5.0.rc1, <=0.5.2), io.undertow:undertow-servlet (1.0.0.final) +46 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.0.0.final)

io.undertow:undertow-core MAVEN version 1.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.wuic:wuic-test =0.5.0.rc1, =1.0.0, =1.0-alpha-2, =1.0-alpha-3, =4.0.0.alpha1, =4.0.0.alpha3 ...

io.undertow:undertow-servlet (1.0.0.cr3), io.undertow:undertow-websockets-jsr (1.0.0.cr3) potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.0.0.cr3)

io.undertow:undertow-core MAVEN version 1.0.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.cr3 - io.undertow:undertow-websockets-jsr 1.0.0.cr3 Source cves:...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), com.brinkus.labs:labs-cloud-starter-service (1.6.0) +176 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.4.11.final)

io.undertow:undertow-core MAVEN version 1.4.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - br.jus.stf.digital:core =2.0.0, =1.0, =1.2.7, =1.2.7, =1.2.7, =1.2.7, =1.2.7, =1.3.4, =1.2.7, =1.2.7,...

io.undertow:undertow-servlet (1.0.0.alpha21), io.undertow:undertow-websockets-jsr (1.0.0.alpha21) +26 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.0.0.alpha21)

io.undertow:undertow-core MAVEN version 1.0.0.alpha21 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha21 - io.undertow:undertow-websockets-jsr 1.0.0.alpha21 -...

io.github.rzo1.org.apache.cxf:apache-cxf (4.2.0-tomee-m0-071068f), io.github.rzo1.org.apache.cxf:cxf-distribution-javadoc (4.2.0-tomee-m0-071068f) +11 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (2.4.0.alpha1)

io.undertow:undertow-core MAVEN version 2.4.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.github.rzo1.org.apache.cxf:apache-cxf 4.2.0-tomee-m0-071068f -...

com.brinkus.labs:labs-cloud-starter-service (>=1.5.0, <=1.5.1), com.fizzed:ninja-undertow (6.0.0-undertow1) +106 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.4.8.final)

io.undertow:undertow-core MAVEN version 1.4.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.brinkus.labs:labs-cloud-starter-service =1.5.0, =1.5.1 - com.fizzed:ninja-undertow 6.0.0-undertow1 ...