GHSA-339q-62wm-c39w

Undertow vulnerable to Denial of Service (DoS) attacks

Source: GitHub Advisory Database (reviewed) High CVE-2021-3859

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.undertow:undertow-core	< 2.2.15	2.2.15

Details

As written in the advisory (Markdown source, shown as plain text).

Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3859 advisory
https://github.com/undertow-io/undertow/pull/1296 web
https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8 web
https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 web
https://access.redhat.com/security/cve/cve-2021-3859 web
https://bugzilla.redhat.com/show_bug.cgi?id=2010378 web
https://github.com/undertow-io/undertow package
https://issues.redhat.com/browse/UNDERTOW-1979 web
https://security.netapp.com/advisory/ntap-20221201-0004 web