The vulnerability exists in the Undertow HTTP server used by Red Hat JBoss Enterprise Application Platform. Specifically, the FormEncodedDataDefinition.doParse(StreamSourceChannel) method fails to properly handle large form data encoded with application/x-www-form-urlencoded, leading to an OutOfMemory condition. This flaw allows unauthenticated remote attackers to cause a denial of service by exhausting server memory resources. Red Hat has fixed this issue in JBoss EAP 8.1.3 by upgrading the Undertow component to version 2.3.20.SP4-redhat-00001.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service by triggering an OutOfMemory error on the server. This results in service disruption but does not impact confidentiality or integrity. The CVSS v3.1 base score is 7.5 (High) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Red Hat has released an official security update in Red Hat JBoss Enterprise Application Platform version 8.1.3 that fixes this vulnerability by upgrading the Undertow component. Users should apply this update promptly. Before updating, ensure all previous errata are applied and back up existing installations and configurations. For detailed update instructions, refer to Red Hat's official guidance at https://access.redhat.com/articles/11258. No other mitigations are specified by the vendor.