HIGH 7.5 Maven
Undertow vulnerable to memory exhaustion due to buffer leak
GHSA-fj7c-vg2v-ccrm · CVE-2021-3690
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Buffer leak on incoming WebSocket PONG message(s) in Undertow before 2.0.40 and 2.2.10 can lead to memory exhaustion and allow a denial of service.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-3690
- WEB https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877
- WEB https://access.redhat.com/security/cve/CVE-2021-3690
- WEB https://access.redhat.com/security/cve/cve-2021-3690#cve-cvss-v3
- WEB https://bugzilla.redhat.com/show_bug.cgi?id=1991299
- PACKAGE https://github.com/undertow-io/undertow
- WEB https://issues.redhat.com/browse/UNDERTOW-1935
- WEB https://www.mend.io/vulnerability-database/CVE-2021-3690
Ready to move
Start Securing
Free, no credit card | First findings in minutes