Back

HIGH

wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage

Published Mar 12, 2018

Description

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.

Affected products

Remediation

No remediation recorded yet.

Metrics

References (18)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 12, 2018
Updated Aug 6, 2024
Reserved Nov 23, 2016
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Moderate
Public date Mar 22, 2017
GHSA-P4XG-CPR9-VWVJ