Loading vulnerability…
Undertow @MultipartConfig Multipart Memory Exhaustion
CVE-2023-3223 is an uncontrolled resource-consumption vulnerability in Undertow multipart request processing. A servlet annotated with @MultipartConfig can consume excessive heap memory while handling oversized multipart content, resulting in an OutOfMemoryError. Deployments that rely on the multipart fileSizeThreshold setting to constrain file sizes may be bypassed when the attacker supplies a null filename in the multipart request.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can cause denial of service by submitting a crafted, oversized multipart request to a vulnerable endpoint. Heap exhaustion can trigger an OutOfMemoryError and make the affected Java application or service unavailable. The fileSizeThreshold bypass can defeat an intended file-size control, increasing the practicality of memory-exhaustion attacks.
If you can’t patch tonight, do this now.
Enforce strict request-body and multipart upload-size limits at a reverse proxy, load balancer, WAF, or application layer before requests reach Undertow. Restrict access to multipart upload endpoints where feasible, apply rate limiting and connection/request quotas, and monitor heap utilization and multipart-request volumes. Do not rely solely on fileSizeThreshold as a security boundary, because a null multipart filename can bypass that limit in vulnerable versions.
Patch, then assume compromise.
Update Undertow or the affected product distribution to a vendor release containing the CVE-2023-3223 fix. For Red Hat JBoss EAP 7.4, apply the 7.4.12 update or a later supported cumulative update. For Red Hat Single Sign-On 7.6, update to 7.6.5 or later supported releases. Red Hat Fuse and EAP extended-support deployments should install their applicable vendor security errata.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.