Read the docs
TI-2021-02544 Aliases CVE-2021-3597GHSA-mfhv-gwf8-4m88

Race condition in undertow

Priority LOW 29CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 11 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

Why it matters now

EPSS 0.01161 67th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.2.9.Final, 2.0.39.FinalRed Hat: 11 advisoriesRed Hat: 11 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—undertowundertow 2.0.35.SP1, undertow 2.2.6.SP1, undertow 2.2.7.SP1, undertow 2.0.36.SP1, undertow 2.2.9.Final, undertow 2.0.39.Final—No fix listedCNA
—io.undertow:undertow-core (Maven)2.1.0 to before 2.2.9.Final2.2.9.FinalPatch availableGHSA-mfhv-gwf8-4m88
—io.undertow:undertow-core (Maven)before 2.0.39.Final2.0.39.FinalPatch availableGHSA-mfhv-gwf8-4m88
  • undertow Vendor— Affected undertow 2.0.35.SP1, undertow 2.2.6.SP1, undertow 2.2.7.SP1, undertow 2.0.36.SP1, undertow 2.2.9.Final, undertow 2.0.39.Final Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected 2.1.0 to before 2.2.9.Final Fixed in 2.2.9.Final Patch available GHSA-mfhv-gwf8-4m88
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.0.39.Final Fixed in 2.0.39.Final Patch available GHSA-mfhv-gwf8-4m88

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.0.35; 2.2.0 to before 2.2.6VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.35:-:*:*:*:*:*:*2.0.35VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.36:-:*:*:*:*:*:*2.0.36VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.39:-:*:*:*:*:*:*2.0.39VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.2.6:-:*:*:*:*:*:*2.2.6VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.2.7:-:*:*:*:*:*:*2.2.7VulnerableRed Hat
  • cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.0.35; 2.2.0 to before 2.2.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.35:-:*:*:*:*:*:* Versions 2.0.35 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.36:-:*:*:*:*:*:* Versions 2.0.36 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.39:-:*:*:*:*:*:* Versions 2.0.39 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.2.6:-:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.2.7:-:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·Red Hat
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:2.2.9:-:*:*:*:*:*:*2.2.9VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:redhat:undertow:2.2.9:-:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-mfhv-gwf8-4m88 io.undertow:undertow-core (Maven) Fixed in 2.2.9.Final Advisory →
  • Fix · GHSA-mfhv-gwf8-4m88 io.undertow:undertow-core (Maven) Fixed in 2.0.39.Final Advisory →

Red Hat 11 advisories

  • RHSA-2022:1179 Released 2022-04-12 · Red Hat rating Important
    Red Hat support for Spring Boot 2.5.10 update
    • Red Hat Support for Spring Boot 2.5.10
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:3660 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update
    • Red Hat JBoss Enterprise Application Platform commons-io.commons-io-2.10.0.redhat-00001.jar, io.netty.netty-all-4.1.63.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.9.SP1-redhat-00001.jar +5
Show 8 more Red Hat advisories
  • RHSA-2021:3658 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
  • RHSA-2021:3656 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap +11
  • RHSA-2021:3534 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update
    • Red Hat Single Sign-On 7.4.9
  • RHSA-2021:3516 Released 2021-09-13 · Red Hat rating Important
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
  • RHSA-2021:3468 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el8eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el8eap +47
  • RHSA-2021:3467 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el7eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el7eap +47
  • RHSA-2021:3466 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el6eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el6eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el6eap +47
  • RHSA-2021:3471 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update
    • EAP 7.3.9 release

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat support for Spring BootAffectedNo fix yet
EAP 7.3.9 releaseFixed RHSA-2021:3471
Red Hat EAP-XP 2.0.0 via EAP 7.3.x baseFixed RHSA-2021:3516
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:3468
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:3466
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:3467
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:3656
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:3658
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:3660
Red Hat Single Sign-On 7.4.9Fixed RHSA-2021:3534
Red Hat Support for Spring Boot 2.5.10Fixed RHSA-2022:1179
Not affected: 9 products
  • Red Hat Decision Manager 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3597
  2. 2026-10-03 Alias added: GHSA-mfhv-gwf8-4m88

References

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences