CVE-2023-1973

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Red HatRed Hat JBoss Enterprise Application Platform 7—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 8—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 9—
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 7—
Red HatRed Hat JBoss Enterprise Application Platform 8—
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8—
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9—

References

Timeline

Published
Nov 7, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-19746.5Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.CVE-2023-19756.5Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.CVE-2023-19768.8Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.CVE-2023-19778.8The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events fromCVE-2023-19786.1The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in vCVE-2023-19796.5The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is theCVE-2023-19806.5Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factorCVE-2023-19815.5A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crashCVE-2023-19824.8The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege useCVE-2023-19839.8A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as critical. Affected by this issue is soCVE-2023-19849.8A vulnerability classified as critical was found in SourceCodester Complaint Management System 1.0. This vulnerability affects unknown code CVE-2023-19857.2A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. This issue affects