CVEvulnerability

CVE-2021-3597

5.9 MEDIUM Published 2022-05-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:N/I:N/A:P
Weaknesses
CWE-362

Description

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

Affected configurations

• redhat fuse 1.0 • redhat jboss enterprise application platform • redhat openshift application runtimes • redhat single sign-on • redhat undertow (< 2.0.35) • redhat undertow (>= 2.2.0 < 2.2.6) • redhat undertow 2.0.35 • redhat undertow 2.0.36 • redhat undertow 2.0.39 • redhat undertow 2.2.6 • redhat undertow 2.2.7 • redhat undertow 2.2.9 • redhat jboss enterprise application platform 7.3 • redhat jboss enterprise application platform 7.4 • netapp active iq unified manager • netapp oncommand insight • netapp oncommand workflow automation

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References