Severity
7.5HIGH
EPSS
0.3%
top 45.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 26

Description

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

NVDredhat/undertow< 2.2.15
Debianundertow< 2.2.16-1
CVEListV5undertowFixed in 2.2.15.Final
NVDredhat/single_sign-on7.4.10, 7.5.1+1

Patches

🔴Vulnerability Details

4
OSV
CVE-2021-3859: A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP22022-08-26
CVEList
CVE-2021-3859: A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP22022-08-26
GHSA
Undertow vulnerable to Denial of Service (DoS) attacks2022-07-15
OSV
Undertow vulnerable to Denial of Service (DoS) attacks2022-07-15

📋Vendor Advisories

2
Red Hat
undertow: client side invocation timeout raised when calling over HTTP22022-02-01
Debian
CVE-2021-3859: undertow - A flaw was found in Undertow that tripped the client-side invocation timeout wit...2021
CVE-2021-3859 (HIGH CVSS 7.5) | A flaw was found in Undertow that t | cvebase.io