GitHub Advisoryadvisory · Maven

GHSA-gjjx-gqm4-wcgm Uncontrolled Resource Consumption in Undertow

MEDIUM Published 2022-05-13 Modified 2022-06-29 Official page ↗
Aliases
CVE-2018-1114
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2022-06-29

Affected packages

• Maven io.undertow:undertow-core: < 1.4.25.Final → fixed in 1.4.25.Final • Maven io.undertow:undertow-core: >= 2.0.0.Alpha1, < 2.0.5.Final → fixed in 2.0.5.Final

Description

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

Related

Alias · CVE (1)

  • CVE-2018-1114 It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References