CVE-2021-3629

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.

Published: May 24, 2022
Updated: May 9, 2024
CVE: CVE-2021-3629
GHSA: GHSA-rf6q-vx79-mjxr
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.9
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-400

Affected Software
References

Software	From	Fixed in
redhat / wildfly_core	-	17.0
redhat / undertow	2.2.0	2.2.11
redhat / undertow	-	2.0.40
redhat / jboss_enterprise_application_platform	7.4	7.4.x
redhat / jboss_enterprise_application_platform	7.3	7.3.x
io.undertow / undertow-core	-	2.0.40.Final
io.undertow / undertow-core	2.1.0	2.2.11.Final

https://bugzilla.redhat.com/show_bug.cgi?id=1977362
https://security.netapp.com/advisory/ntap-20220729-0008/

Vulnerability Database

CVE-2021-3629

Deep Security Visibility Without the Complexity