CVE-2023-3223
published 2023-09-27CVE-2023-3223: A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.66%
85.6th percentile
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | undertow | < undertow 2.3.18-1 (forky) | undertow 2.3.18-1 (forky) |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform_for_ibm_linuxone | — | — |
| redhat | openshift_container_platform_for_ibm_linuxone | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | single_sign-on | — | — |
| redhat | undertow | < 2.2.24 | 2.2.24 |
| redhat | undertow | >= 0 < 2.3.18-1 | 2.3.18-1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
vendor_redhat·2025-10-07·CVSS 7.1
CVE-2023-53646 [HIGH] CWE-125 kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/perf: add sentinel to xehp_oa_b_counters
Arrays passed to reg_in_range_table should end with empty record.
The patch solves KASAN detected bug with signature:
BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]
Read of size 4 at addr ffffffffa1555d90 by task perf/1518
CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1
Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023
Call Trace:
...
xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]
(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)
A bounds-checkin
Red Hat
undertow: OutOfMemoryError due to @MultipartConfig handling
vendor_redhat·2023-08-07·CVSS 7.5
CVE-2023-3223 [HIGH] CWE-789 undertow: OutOfMemoryError due to @MultipartConfig handling
undertow: OutOfMemoryError due to @MultipartConfig handling
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Package: undertow (
Debian
CVE-2023-3223: undertow - A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause...
vendor_debian·2023·CVSS 7.5
CVE-2023-3223 [HIGH] CVE-2023-3223: undertow - A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause...
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Scope: local
forky: resolved (fixed in 2.3.18-1)
sid: resolved (fixed in 2.3.18-1)
OSV
CVE-2023-3223: A flaw was found in undertow
osv·2023-09-27·CVSS 7.5
CVE-2023-3223 [HIGH] CVE-2023-3223: A flaw was found in undertow
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
GHSA
Undertow vulnerable to denial of service
ghsa·2023-09-27
CVE-2023-3223 [HIGH] CWE-400 Undertow vulnerable to denial of service
Undertow vulnerable to denial of service
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
OSV
Undertow vulnerable to denial of service
osv·2023-09-27
CVE-2023-3223 [HIGH] Undertow vulnerable to denial of service
Undertow vulnerable to denial of service
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-53646 kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
bugzilla·2025-10-07·CVSS 7.1
CVE-2023-53646 [HIGH] CVE-2023-53646 kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
CVE-2023-53646 kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/perf: add sentinel to xehp_oa_b_counters
Arrays passed to reg_in_range_table should end with empty record.
The patch solves KASAN detected bug with signature:
BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]
Read of size 4 at addr ffffffffa1555d90 by task perf/1518
CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1
Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023
Call Trace:
...
xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]
(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b21879
Bugzilla
CVE-2023-3223 undertow: OutOfMemoryError due to @MultipartConfig handling
bugzilla·2023-05-24·CVSS 7.5
CVE-2023-3223 [HIGH] CVE-2023-3223 undertow: OutOfMemoryError due to @MultipartConfig handling
CVE-2023-3223 undertow: OutOfMemoryError due to @MultipartConfig handling
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause OutOfMemoryError due to huge sized multipart content .This vulnerability can be exploited by unauthorized users to cause remote Denial-of-Service (DoS) attack. And if the server use fileSizeThreshold for the file size limit, it's possible to bypass the limit by setting the file name in the request to null.
Discussion:
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2023:4509 https://access.redhat.com/errata/RHSA-2023:4509
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Via RHSA-2023:4505 https:
Bugzilla
CVE-2023-0833 Streams: component version with information disclosure flaw
bugzilla·2023-02-14·CVSS 5.5
CVE-2023-0833 [MEDIUM] CVE-2023-0833 Streams: component version with information disclosure flaw
CVE-2023-0833 Streams: component version with information disclosure flaw
It was found that Red Hat's AMQ-Streams ships a version of OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. An authenticated attacker could possibly use this flaw to access information outside of their regular permissions.
Discussion:
This issue has been addressed in the following products:
Red Hat AMQ Streams 2.2.1
Via RHSA-2023:1241 https://access.redhat.com/errata/RHSA-2023:1241
---
This issue has been addressed in the following products:
Red Hat AMQ Streams 2.4.0
Via RHSA-2023:3223 https://access.redhat.com/errata/RHSA-2023:3223
https://access.redhat.com/errata/RHSA-2023:4505https://access.redhat.com/errata/RHSA-2023:4506https://access.redhat.com/errata/RHSA-2023:4507https://access.redhat.com/errata/RHSA-2023:4509https://access.redhat.com/errata/RHSA-2023:4918https://access.redhat.com/errata/RHSA-2023:4919https://access.redhat.com/errata/RHSA-2023:4920https://access.redhat.com/errata/RHSA-2023:4921https://access.redhat.com/errata/RHSA-2023:4924https://access.redhat.com/errata/RHSA-2023:7247https://access.redhat.com/security/cve/CVE-2023-3223https://bugzilla.redhat.com/show_bug.cgi?id=2209689https://security.netapp.com/advisory/ntap-20231027-0004/https://access.redhat.com/errata/RHSA-2023:4505https://access.redhat.com/errata/RHSA-2023:4506https://access.redhat.com/errata/RHSA-2023:4507https://access.redhat.com/errata/RHSA-2023:4509https://access.redhat.com/errata/RHSA-2023:4918https://access.redhat.com/errata/RHSA-2023:4919https://access.redhat.com/errata/RHSA-2023:4920https://access.redhat.com/errata/RHSA-2023:4921https://access.redhat.com/errata/RHSA-2023:4924https://access.redhat.com/errata/RHSA-2023:7247https://access.redhat.com/security/cve/CVE-2023-3223https://bugzilla.redhat.com/show_bug.cgi?id=2209689https://security.netapp.com/advisory/ntap-20231027-0004/
2023-09-27
Published