Search for vulnerabilities
Vulnerability details: VCID-5r27-rz68-aaak
Vulnerability ID VCID-5r27-rz68-aaak
Aliases CVE-2023-1973
GHSA-97cq-f4jm-mv8h
Summary undertow: unrestricted request storage leads to memory exhaustion
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2024:1674
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1674
ssvc Track https://access.redhat.com/errata/RHSA-2024:1674
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2024:1675
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1675
ssvc Track https://access.redhat.com/errata/RHSA-2024:1675
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2024:1676
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1676
ssvc Track https://access.redhat.com/errata/RHSA-2024:1676
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2024:1677
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1677
ssvc Track https://access.redhat.com/errata/RHSA-2024:1677
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2024:2763
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:2763
ssvc Track https://access.redhat.com/errata/RHSA-2024:2763
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2024:2764
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:2764
ssvc Track https://access.redhat.com/errata/RHSA-2024:2764
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1973.json
cvssv3.1 7.5 https://access.redhat.com/security/cve/CVE-2023-1973
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2023-1973
ssvc Track https://access.redhat.com/security/cve/CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00109 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00328 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00328 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00328 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00328 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00574 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00574 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00574 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00574 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00654 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00663 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00682 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00682 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00682 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.00903 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.01004 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.01004 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.01451 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.01451 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.01451 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.03222 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04062 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04062 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04062 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04496 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04496 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04496 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04496 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04496 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04496 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.04496 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.06365 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
epss 0.07279 https://api.first.org/data/v1/epss?cve=CVE-2023-1973
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=2185662
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2185662
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2185662
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-97cq-f4jm-mv8h
cvssv3.1 7.5 https://github.com/undertow-io/undertow
generic_textual MODERATE https://github.com/undertow-io/undertow
cvssv3.1 7.5 https://github.com/undertow-io/undertow/commit/0410f3c4d9b39b754a2203a29834cac51da11258
generic_textual MODERATE https://github.com/undertow-io/undertow/commit/0410f3c4d9b39b754a2203a29834cac51da11258
cvssv3.1 7.5 https://github.com/undertow-io/undertow/commit/b289b18bc0ba40c134698a430c70ca1835c51d78
generic_textual MODERATE https://github.com/undertow-io/undertow/commit/b289b18bc0ba40c134698a430c70ca1835c51d78
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-1973
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-1973
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-1973
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2024:1674
https://access.redhat.com/errata/RHSA-2024:1675
https://access.redhat.com/errata/RHSA-2024:1676
https://access.redhat.com/errata/RHSA-2024:1677
https://access.redhat.com/errata/RHSA-2024:2763
https://access.redhat.com/errata/RHSA-2024:2764
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1973.json
https://access.redhat.com/security/cve/CVE-2023-1973
https://api.first.org/data/v1/epss?cve=CVE-2023-1973
https://github.com/undertow-io/undertow
https://github.com/undertow-io/undertow/commit/0410f3c4d9b39b754a2203a29834cac51da11258
https://github.com/undertow-io/undertow/commit/b289b18bc0ba40c134698a430c70ca1835c51d78
https://nvd.nist.gov/vuln/detail/CVE-2023-1973
1068815 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068815
2185662 https://bugzilla.redhat.com/show_bug.cgi?id=2185662
cpe:/a:redhat:jboss_enterprise_application_platform:7.4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:7.4
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
cpe:/a:redhat:jboss_enterprise_application_platform:8.0 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:8.0
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
GHSA-97cq-f4jm-mv8h https://github.com/advisories/GHSA-97cq-f4jm-mv8h
RHSA-2025:4226 https://access.redhat.com/errata/RHSA-2025:4226
RHSA-2025:9583 https://access.redhat.com/errata/RHSA-2025:9583
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2024:1674
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://access.redhat.com/errata/RHSA-2024:1674
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2024:1675
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://access.redhat.com/errata/RHSA-2024:1675
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2024:1676
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://access.redhat.com/errata/RHSA-2024:1676
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2024:1677
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://access.redhat.com/errata/RHSA-2024:1677
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2024:2763
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://access.redhat.com/errata/RHSA-2024:2763
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2024:2764
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://access.redhat.com/errata/RHSA-2024:2764
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1973.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/security/cve/CVE-2023-1973
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://access.redhat.com/security/cve/CVE-2023-1973
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2185662
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:06:28Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2185662
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/undertow-io/undertow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/undertow-io/undertow/commit/0410f3c4d9b39b754a2203a29834cac51da11258
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/undertow-io/undertow/commit/b289b18bc0ba40c134698a430c70ca1835c51d78
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-1973
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-1973
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.45181
EPSS Score 0.00109
Published At Nov. 18, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-04-23T17:56:45.547530+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1973.json 34.0.0rc4