CVE-2024-4027 Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks

What is CVE-2024-4027?

CVE-2024-4027 is a high-severity denial of service vulnerability in Red Hat Data Grid 8, published on 30 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.

Weakness: CWE-20

Which versions are affected by CVE-2024-4027?

6 open source packages ship an affected version, including io.undertow:undertow-core.

How do I fix CVE-2024-4027?

Upgrade io.undertow:undertow-core to a fixed version for your release line: 2.2.39.Final, 2.3.21.Final or 2.4.0.Beta1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-4027 being exploited?

There is no known exploitation of CVE-2024-4027 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1778546708, CLSA-2026-1784769562, DEBIAN-CVE-2024-4027, GHSA-33hj-rcmx-86mv, UBUNTU-CVE-2024-4027.