high7.5
CVE-2021-3690
Undertow vulnerable to memory exhaustion due to buffer leak
Impact
Buffer leak on incoming WebSocket PONG message(s) in Undertow before 2.0.40 and 2.2.10 can lead to memory exhaustion and allow a denial of service.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | < 2.0.40 | 2.0.40 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Fuse | Version 1.0 |
| Redhat | Integration Camel K | All versions |
| Redhat | Integration Camel Quarkus | All versions |
| Redhat | Jboss Enterprise Application Platform | All versions Versions 7.3, 7.4 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Single Sign-On | All versions |
| Redhat | Undertow | before 2.0.40 from 2.1.0 before 2.2.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/security/cve/CVE-2021-3690
- https://bugzilla.redhat.com/show_bug.cgi?id=1991299
- https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877
- https://issues.redhat.com/browse/UNDERTOW-1935
- https://github.com/advisories/GHSA-fj7c-vg2v-ccrm
- https://nvd.nist.gov/vuln/detail/CVE-2021-3690
- https://access.redhat.com/security/cve/cve-2021-3690#cve-cvss-v3
- https://www.mend.io/vulnerability-database/CVE-2021-3690