CVE-2021-3629
published 2022-05-24CVE-2021-3629: A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of…
PriorityP429medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
1.18%
64.0th percentile
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | undertow | < undertow 2.2.12-1 (forky) | undertow 2.2.12-1 (forky) |
| debian | undertow | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | single_sign-on | — | — |
| redhat | undertow | < 2.0.40 | 2.0.40 |
| redhat | undertow | <= 2.2.17 | — |
| redhat | undertow | — | — |
| redhat | undertow | — | — |
| redhat | undertow | — | — |
| redhat | undertow | >= 0 < 2.2.12-1 | 2.2.12-1 |
| redhat | undertow | >= 2.2.0 < 2.2.11 | 2.2.11 |
| redhat | wildfly_core | < 17.0 | 17.0 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5837-3xvj-5g8r: A flaw was found in Undertow
ghsa_unreviewed·2022-09-01·CVSS 5.9
CVE-2022-1259 [MEDIUM] CWE-400 GHSA-5837-3xvj-5g8r: A flaw was found in Undertow
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
OSV
CVE-2022-1259: A flaw was found in Undertow
osv·2022-08-31·CVSS 5.9
CVE-2022-1259 [MEDIUM] CVE-2022-1259: A flaw was found in Undertow
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
OSV
Undertow Uncontrolled Resource Consumption
osv·2022-05-25
CVE-2021-3629 [HIGH] Undertow Uncontrolled Resource Consumption
Undertow Uncontrolled Resource Consumption
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
GHSA
Undertow Uncontrolled Resource Consumption
ghsa·2022-05-25
CVE-2021-3629 [HIGH] CWE-400 Undertow Uncontrolled Resource Consumption
Undertow Uncontrolled Resource Consumption
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
OSV
CVE-2021-3629: A flaw was found in Undertow
osv·2022-05-24·CVSS 5.9
CVE-2021-3629 [MEDIUM] CVE-2021-3629: A flaw was found in Undertow
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
Red Hat
undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
vendor_redhat·2022-04-06·CVSS 5.9
CVE-2022-1259 [MEDIUM] CWE-400 undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.
Statement: This flaw occurs because of an incomplete fix for CVE-2021-3629.
Package: undertow (Red Hat build of Quarkus) - Will not fix
Package: undertow (Red Hat Decision Manager 7) - Not affected
Package: undertow (Red Hat Integration Camel K 1) - Fix deferred
Package: undertow (R
Debian
CVE-2022-1259: undertow - A flaw was found in Undertow. A potential security issue in flow control handlin...
vendor_debian·2022·CVSS 5.9
CVE-2022-1259 [MEDIUM] CVE-2022-1259: undertow - A flaw was found in Undertow. A potential security issue in flow control handlin...
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
Scope: local
forky: resolved
sid: resolved
Red Hat
undertow: potential security issue in flow control over HTTP/2 may lead to DOS
vendor_redhat·2021-03-29·CVSS 5.9
CVE-2021-3629 [MEDIUM] CWE-400 undertow: potential security issue in flow control over HTTP/2 may lead to DOS
undertow: potential security issue in flow control over HTTP/2 may lead to DOS
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability.
Package: undertow (Red Hat build of Quarkus) - Not affected
Package: undertow (Red Hat Decision Manager 7) - Not affected
Package: undertow (Red Hat Integr
Debian
CVE-2021-3629: undertow - A flaw was found in Undertow. A potential security issue in flow control handlin...
vendor_debian·2021·CVSS 5.9
CVE-2021-3629 [MEDIUM] CVE-2021-3629: undertow - A flaw was found in Undertow. A potential security issue in flow control handlin...
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
Scope: local
forky: resolved (fixed in 2.2.12-1)
sid: resolved (fixed in 2.2.12-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-05-24
Published