CVE-2023-3223
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2023
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Undertow: outofmemoryerror due to @multipartconfig handling
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Fuse 7.12.1
- Vendor
- Red Hat
- Product
- Red Hat Fuse 7.12.1
- Platforms
- Unknown
- Default status
unaffected- Package
- undertow
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform 7.1.0
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7.1.0
- Platforms
- Unknown
- Default status
unaffected- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
- Platforms
- Unknown
- Default status
affected- Package
- eap7-undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0:2.2.25-3.SP3_redhat_00001.1.el8eap | unaffected | rpm | * | Unavailable | None listed |
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
- Platforms
- Unknown
- Default status
affected- Package
- eap7-undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0:2.2.25-3.SP3_redhat_00001.1.el9eap | unaffected | rpm | * | Unavailable | None listed |
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
- Platforms
- Unknown
- Default status
affected- Package
- eap7-undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0:2.2.25-3.SP3_redhat_00001.1.el7eap | unaffected | rpm | * | Unavailable | None listed |
Red Hat Single Sign-On 7.6.5
- Vendor
- Red Hat
- Product
- Red Hat Single Sign-On 7.6.5
- Platforms
- Unknown
- Default status
unaffected- Package
- undertow
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat Single Sign-On 7.6 for RHEL 7
- Vendor
- Red Hat
- Product
- Red Hat Single Sign-On 7.6 for RHEL 7
- Platforms
- Unknown
- Default status
affected- Package
- rh-sso7-keycloak
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0:18.0.9-1.redhat_00001.1.el7sso | unaffected | rpm | * | Unavailable | None listed |
Red Hat Single Sign-On 7.6 for RHEL 8
- Vendor
- Red Hat
- Product
- Red Hat Single Sign-On 7.6 for RHEL 8
- Platforms
- Unknown
- Default status
affected- Package
- rh-sso7-keycloak
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0:18.0.9-1.redhat_00001.1.el8sso | unaffected | rpm | * | Unavailable | None listed |
Red Hat Single Sign-On 7.6 for RHEL 9
- Vendor
- Red Hat
- Product
- Red Hat Single Sign-On 7.6 for RHEL 9
- Platforms
- Unknown
- Default status
affected- Package
- rh-sso7-keycloak
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0:18.0.9-1.redhat_00001.1.el9sso | unaffected | rpm | * | Unavailable | None listed |
RHEL-8 based Middleware Containers
- Vendor
- Red Hat
- Product
- RHEL-8 based Middleware Containers
- Platforms
- Unknown
- Default status
affected- Package
- rh-sso-7/sso76-openshift-rhel8
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 7.6-27 | unaffected | rpm | * | Unavailable | None listed |
Red Hat build of Quarkus
- Vendor
- Red Hat
- Product
- Red Hat build of Quarkus
- Platforms
- Unknown
- Default status
unaffected- Package
- io.quarkus/quarkus-undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Data Grid 8
- Vendor
- Red Hat
- Product
- Red Hat Data Grid 8
- Platforms
- Unknown
- Default status
unaffected- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Decision Manager 7
- Vendor
- Red Hat
- Product
- Red Hat Decision Manager 7
- Platforms
- Unknown
- Default status
affected- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Integration Camel K
- Vendor
- Red Hat
- Product
- Red Hat Integration Camel K
- Platforms
- Unknown
- Default status
affected- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Integration Service Registry
- Vendor
- Red Hat
- Product
- Red Hat Integration Service Registry
- Platforms
- Unknown
- Default status
affected- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Data Grid 7
- Vendor
- Red Hat
- Product
- Red Hat JBoss Data Grid 7
- Platforms
- Unknown
- Default status
unknown- Package
- undertow
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform Expansion Pack
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Platforms
- Unknown
- Default status
unaffected- Package
- undertow
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Fuse 6
- Vendor
- Red Hat
- Product
- Red Hat JBoss Fuse 6
- Platforms
- Unknown
- Default status
unknown- Package
- undertow
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat OpenStack Platform 13 (Queens) Operational Tools
- Vendor
- Red Hat
- Product
- Red Hat OpenStack Platform 13 (Queens) Operational Tools
- Platforms
- Unknown
- Default status
unknown- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Process Automation 7
- Vendor
- Red Hat
- Product
- Red Hat Process Automation 7
- Platforms
- Unknown
- Default status
affected- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat support for Spring Boot
- Vendor
- Red Hat
- Product
- Red Hat support for Spring Boot
- Platforms
- Unknown
- Default status
unaffected- Package
- undertow
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.