CVEvulnerability

CVE-2023-3223

7.5 HIGH Published 2023-09-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-09-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-789

Description

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Affected configurations

• redhat undertow (< 2.2.24) • redhat openshift container platform 4.11 • redhat openshift container platform 4.12 • redhat openshift container platform for ibm linuxone 4.9 • redhat openshift container platform for ibm linuxone 4.10 • redhat openshift container platform for power 4.9 • redhat openshift container platform for power 4.10 • redhat jboss enterprise application platform text-only advisories • redhat single sign-on • redhat single sign-on 7.6 • redhat jboss enterprise application platform 7.4

Related

Weakness · CWE (1)

  • CWE-789 Memory Allocation with Excessive Size Value weakness

References