{"id":"CVE-2023-1973","state":"PUBLISHED","title":"Undertow: unrestricted request storage leads to memory exhaustion","description":"A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.","publishedAt":"2024-11-07T10:01:57.995Z","updatedAt":"2024-11-07T14:06:43.345Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat JBoss Enterprise Application Platform 7","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","Red Hat Red Hat JBoss Enterprise Application Platform 8","Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9"],"affected":[{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.30-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.30-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.30-1.SP1_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"undertow","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-undertow","defaultStatus":"affected","versions":[{"version":"0:2.3.11-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-undertow","defaultStatus":"affected","versions":[{"version":"0:2.3.11-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]}],"references":["https://access.redhat.com/errata/RHSA-2024:1674","https://access.redhat.com/errata/RHSA-2024:1675","https://access.redhat.com/errata/RHSA-2024:1676","https://access.redhat.com/errata/RHSA-2024:1677","https://access.redhat.com/errata/RHSA-2024:2763","https://access.redhat.com/errata/RHSA-2024:2764","https://access.redhat.com/security/cve/CVE-2023-1973","https://bugzilla.redhat.com/show_bug.cgi?id=2185662"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/1xxx/CVE-2023-1973.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-1973","state":"PUBLISHED","datePublished":"2024-11-07T10:01:57.995Z","dateUpdated":"2024-11-07T14:06:43.345Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-04-10T23:29:16.249Z"},"containers":{"cna":{"title":"Undertow: unrestricted request storage leads to memory exhaustion","descriptions":[{"lang":"en","value":"A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory."}],"affected":[{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.30-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.30-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.30-1.SP1_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"undertow","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-undertow","defaultStatus":"affected","versions":[{"version":"0:2.3.11-1.SP1_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-undertow","defaultStatus":"affected","versions":[{"version":"0:2.3.11-1.SP1_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:1674","name":"RHSA-2024:1674","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1675","name":"RHSA-2024:1675","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1676","name":"RHSA-2024:1676","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1677","name":"RHSA-2024:1677","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2763","name":"RHSA-2024:2763","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2764","name":"RHSA-2024:2764","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1973","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185662","name":"RHBZ#2185662","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2024-11-07T10:01:57.995Z"},"datePublic":"2024-04-04T00:00:00.000Z","x_redhatCweChain":"CWE-20: Improper Input Validation","timeline":[{"lang":"en","time":"2023-02-20T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-04-04T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-07T14:06:28.900126Z","id":"CVE-2023-1973","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-07T14:06:43.345Z"}}]}}}