CVE-2023-3223

CVE-2023-3223 is a high-severity denial-of-service vulnerability affecting Undertow and various Red Hat products, including Enterprise Linux and JBoss EAP. The flaw allows unauthorized users to trigger an OutOfMemoryError by sending large multipart content to servlets annotated with @MultipartConfig, potentially bypassing file size limits by setting a null filename. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, leading to high availability impact. There is currently no evidence of active exploitation, and no public exploit code or significant community discussion has been observed.