GitHub Advisoryadvisory · Maven

GHSA-m4mm-pg93-fv78 Undertow denial of service vulnerability

HIGH Published 2023-09-14 Modified 2024-05-03 Official page ↗

Aliases: CVE-2023-1108
Ecosystem: Maven
Packages: io.undertow:undertow-core
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-835
Reviewed: 2023-09-15

Affected packages

• Maven io.undertow:undertow-core: >= 2.3.0, < 2.3.5.Final → fixed in 2.3.5.Final • Maven io.undertow:undertow-core: < 2.2.24.Final → fixed in 2.2.24.Final

Description

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Alias · CVE (1)

CVE-2023-1108 A flaw was found in undertow. vulnerability

Weakness · CWE (1)

CWE-835 Loop with Unreachable Exit Condition weakness

References