GitHub Advisoryadvisory · Maven
GHSA-339q-62wm-c39w Undertow vulnerable to Denial of Service (DoS) attacks
HIGH
Official page ↗
- Aliases
- CVE-2021-3859
- Ecosystem
- Maven
- Packages
- io.undertow:undertow-core
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-214, CWE-400, CWE-668
- Reviewed
- 2022-07-15
Affected packages
• Maven io.undertow:undertow-core: < 2.2.15 → fixed in 2.2.15
Description
Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.
Related
Alias · CVE (1)
- CVE-2021-3859 A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-3859 advisory
- https://github.com/undertow-io/undertow/pull/1296 web
- https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8 web
- https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 web
- https://access.redhat.com/security/cve/cve-2021-3859 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2010378 web
- https://github.com/undertow-io/undertow package
- https://issues.redhat.com/browse/UNDERTOW-1979 web
- https://security.netapp.com/advisory/ntap-20221201-0004 web