A vulnerability in the Undertow web server allows unauthenticated remote attackers to trigger a denial of service through memory exhaustion.

The vulnerability exists in the handling of HttpServletRequestImpl.getParameterNames(). An unauthenticated attacker can send a request containing excessively large parameter names to cause an OutOfMemoryError, resulting in a crash of the affected service.

Successful exploitation of this vulnerability results in a denial of service, which can cause significant operational disruption and system downtime for critical business applications. With a CVSS score of 7.5, this high severity flaw poses a substantial risk to service availability, especially for public facing infrastructure running Red Hat OpenShift or Camel services.

Immediate Action: Review the official Red Hat security advisory for the specific patched versions of your deployed products and apply all available updates immediately.

Proactive Monitoring: Monitor server logs and resource utilization metrics for sudden spikes in memory consumption or repeated application crashes that may indicate an ongoing denial of service attempt.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict request size and filter anomalous HTTP requests, which may prevent the delivery of malicious payloads containing oversized parameters.

Public Exploit Available: No confirmed public exploit exists.

Given the potential for high impact service disruption, organizations should prioritize evaluating their exposure across all Red Hat based environments. Ensure that all affected middleware and container platforms are updated to the latest vendor recommended versions to remediate the underlying memory exhaustion risk.