CVE-2023-1973: Undertow: unrestricted request storage leads to memory exhaustion
A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.
Other sources
Undertow's FormAuthenticationMechanism can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1973?
CVE-2023-1973 is categorized as a Denial of Service vulnerability.
How do I fix CVE-2023-1973?
To fix CVE-2023-1973, upgrade to Undertow version 2.3.13.Final or 2.2.32.Final.
What causes CVE-2023-1973?
CVE-2023-1973 is caused by unrestricted request storage in the FormAuthenticationMechanism.
Which versions are affected by CVE-2023-1973?
Versions of Undertow between 2.3.0.Alpha1 and 2.3.13.Final, as well as all versions below 2.2.32.Final, are affected by CVE-2023-1973.
What impact does CVE-2023-1973 have on my system?
CVE-2023-1973 can lead to server memory exhaustion, resulting in Denial of Service.