GHSA-mfhv-gwf8-4m88
undertow Race Condition vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.undertow:undertow-core | >= 2.1.0, < 2.2.9.Final | 2.2.9.Final |
| Maven | io.undertow:undertow-core | < 2.0.39.Final | 2.0.39.Final |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
References
External links from the advisory. They lead to third-party sites.