Description A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Exploitability: 3.9 | Impact: 3.6 Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High
Affected Packages6 packages Show 1 more packages
🔴 Vulnerability Details4 OSV CVE-2021-3859: A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2 ↗ 2022-08-26 ▶ CVEList CVE-2021-3859: A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2 ↗ 2022-08-26 ▶ GHSA Undertow vulnerable to Denial of Service (DoS) attacks ↗ 2022-07-15 ▶ OSV Undertow vulnerable to Denial of Service (DoS) attacks ↗ 2022-07-15 ▶
📋 Vendor Advisories2 Red Hat undertow: client side invocation timeout raised when calling over HTTP2 ↗ 2022-02-01 ▶ Debian CVE-2021-3859: undertow - A flaw was found in Undertow that tripped the client-side invocation timeout wit... ↗ 2021 ▶