high7.5
CVE-2021-3629
Undertow Uncontrolled Resource Consumption
Impact
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | <= 2.0.39.Final | 2.0.40.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Integration | All versions |
| Redhat | Jboss Enterprise Application Platform | All versions Versions 7.4, 7.3 |
| Redhat | Single Sign-On | All versions |
| Redhat | Undertow | before 2.0.40 from 2.2.0 before 2.2.11 |
| Redhat | Wildfly Core | before 17.0 |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Oncommand Insight | All versions |
| Netapp | Oncommand Workflow Automation | All versions |