CVE-2021-3690

CWE-400 — Uncontrolled Resource ConsumptionCWE-401 — Memory Leak8 documents7 sources
Severity
7.5HIGH
EPSS
0.3%
top 48.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat UndertowRedhat FuseRedhat Jboss Enterprise Application Platform
Timeline
PublishedAug 23

Description

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶NVDredhat/undertow2.1.0 — 2.2.10+1
▶Mavenio.undertow:undertow-core2.2.0 — 2.2.10+1
▶Debianundertow< 2.2.10-1
▶CVEListV5undertowFixed in 2.2.10.Final, 2.0.40.Final
▶NVDredhat/fuse1.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
CVEList
CVE-2021-3690: A flaw was found in Undertow↗2022-08-23
▶
OSV
CVE-2021-3690: A flaw was found in Undertow↗2022-08-23
▶
GHSA
Undertow vulnerable to memory exhaustion due to buffer leak↗2022-07-15
▶
OSV
Undertow vulnerable to memory exhaustion due to buffer leak↗2022-07-15
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Communications Risk Matrix: NSSF (Undertow) — CVE-2021-3690↗2022-04-15
▶
Red Hat
undertow: buffer leak on incoming websocket PONG message may lead to DoS↗2021-07-30
▶
Debian
CVE-2021-3690: undertow - A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG messa...↗2021
▶