GitHub Advisoryadvisory · Maven

GHSA-xpp6-8r3j-ww43 Undertow Denial of Service vulnerability

HIGH Published 2024-07-08 Modified 2024-09-30 Official page ↗
Aliases
CVE-2024-5971
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674
Reviewed
2024-07-09

Affected packages

• Maven io.undertow:undertow-core: >= 2.3.0.Alpha1, < 2.3.15.Final → fixed in 2.3.15.Final • Maven io.undertow:undertow-core: < 2.2.34.Final → fixed in 2.2.34.Final

Description

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected `0\r\n` termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.

Related

Alias · CVE (1)

  • CVE-2024-5971 A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References