Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-3223

Good to know:

icon
icon

Date: September 27, 2023

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

Language: Java

Severity Score

Related Resources (15)

https://access.redhat.com/errata/RHSA-2023:4921
https://access.redhat.com/errata/RHSA-2023:4920
https://access.redhat.com/errata/RHSA-2023:4505
https://nvd.nist.gov/vuln/detail/CVE-2023-3223
https://access.redhat.com/errata/RHSA-2023:4918
https://access.redhat.com/security/cve/CVE-2023-3223
https://security.netapp.com/advisory/ntap-20231027-0004/
https://access.redhat.com/errata/RHSA-2023:4919
https://access.redhat.com/errata/RHSA-2023:4507
https://access.redhat.com/errata/RHSA-2023:4506
https://access.redhat.com/errata/RHSA-2023:4924
https://access.redhat.com/errata/RHSA-2023:4509
https://access.redhat.com/errata/RHSA-2023:7247
https://bugzilla.redhat.com/show_bug.cgi?id=2209689
https://www.mend.io/vulnerability-database/CVE-2023-3223

Severity Score

Weakness Type (CWE)

Insufficient Information

NVD-CWE-noinfo

Memory Allocation with Excessive Size Value

CWE-789

Top Fix

icon

Upgrade Version

Upgrade to version io.undertow:undertow-servlet:2.2.25.Final,2.3.7.Final

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us