undertow-io/undertow · Security
Undertow vulnerable to Denial of Service (DoS) attacks
- GHSA ID
- GHSA-339q-62wm-c39w
- CVE ID
- CVE-2021-3859
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.
CWEs
- CWE-214 · Invocation of Process Using Visible Sensitive Information
- CWE-400 · Uncontrolled Resource Consumption
- CWE-668 · Exposure of Resource to Wrong Sphere
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-3859 ↗
- https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8 ↗
- https://access.redhat.com/security/cve/cve-2021-3859 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2010378 ↗
- https://github.com/undertow-io/undertow/pull/1296 ↗
- https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 ↗
- https://issues.redhat.com/browse/UNDERTOW-1979 ↗
- https://security.netapp.com/advisory/ntap-20221201-0004/ ↗
- https://github.com/advisories/GHSA-339q-62wm-c39w ↗