CVE-2016-9589

wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage

Published Mar 12, 2018 CVSS 3.0 · 7.5 High EPSS 3.0% KEV · Not listed
Description
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-4678 Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.
Github GHSA Github GHSA GHSA-p4xg-cpr9-vwvj Red Hat Wildfly DoS
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 2:59 AM
Reserved
Nov 23, 2016, 12:00 AM
Status
Modified
Published
Mar 12, 2018, 3:29 PM
Modified
Jun 17, 2026, 12:56 AM
Severity
Moderate
Public date
Mar 22, 2017, 12:00 AM