Security · Red Hat Undertow
Multiple Undertow Flaws Disclosed, Including Chunked-Response Denial of Service (CVE-2024-5971)
CVE-2024-5971 describes a vulnerability in Undertow where a chunked response hangs after the body is flushed because Undertow does not send the expected 0\r\n chunk terminator, leaving clients waiting and causing uncontrolled resource consumption and denial of service in Java 17 TLSv1.3 scenarios. Related Undertow advisories include CVE-2024-3884 (OutOfMemory condition when parsing large application/x-www-form-urlencoded data), CVE-2025-9784 ("MadeYouReset" server-side stream resets that bypass abuse counters), and CVE-2025-12543 (improper Host header validation in the Undertow HTTP server core used by WildFly, JBoss EAP, and other Java applications).
Read the original coverage at National Vulnerability Database (NVD)
Captured 8 weeks ago