CVE-2023-3223: Undertow: outofmemoryerror due to @multipartconfig handling

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-27 · updated 2026-06-17
Weakness: CWE-789

Description

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Affected products

Red Hat JBoss EAP: 7.4
RedHat Jboss Enterprise Application Platform Text-Only Advisories: all versions
Red Hat OpenShift Container Platform 4.18: 4.11, 4.12
RedHat Openshift Container Platform For Ibm Linuxone: 4.9, 4.10
RedHat Openshift Container Platform For Power: 4.9, 4.10
Red Hat Single Sign-On: 7.6
Red Hat undertow: before 2.2.24 — fixed in 2.2.24

How to fix

Upgrade to a fixed version: Red Hat undertow 2.2.24. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3223 or the next vulnerability affects your stack