Read the docs
TI-2021-02574 Aliases CVE-2021-3629GHSA-rf6q-vx79-mjxr

Uncontrolled resource consumption in undertow

Priority LOW 29CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 14 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.

Why it matters now

EPSS 0.01322 71st percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.0.40.Final, 2.2.11.FinalRed Hat: 14 advisoriesRed Hat: 14 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—undertowundertow 2.0.40.Final, undertow 2.2.11.Final—No fix listedCNA
—io.undertow:undertow-core (Maven)before 2.0.40.Final2.0.40.FinalPatch availableGHSA-rf6q-vx79-mjxr
—io.undertow:undertow-core (Maven)2.1.0 to before 2.2.11.Final2.2.11.FinalPatch availableGHSA-rf6q-vx79-mjxr
  • undertow Vendor— Affected undertow 2.0.40.Final, undertow 2.2.11.Final Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.0.40.Final Fixed in 2.0.40.Final Patch available GHSA-rf6q-vx79-mjxr
  • io.undertow:undertow-core (Maven) Vendor— Affected 2.1.0 to before 2.2.11.Final Fixed in 2.2.11.Final Patch available GHSA-rf6q-vx79-mjxr

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:redhat:integration:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.0.40; 2.2.0 to before 2.2.11VulnerableRed Hat
cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*before 17.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
  • cpe:2.3:a:redhat:integration:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.0.40; 2.2.0 to before 2.2.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:* Versions before 17.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-rf6q-vx79-mjxr io.undertow:undertow-core (Maven) Fixed in 2.0.40.Final Advisory →
  • Fix · GHSA-rf6q-vx79-mjxr io.undertow:undertow-core (Maven) Fixed in 2.2.11.Final Advisory →

Red Hat 14 advisories

  • RHSA-2022:6407 Released 2022-09-09 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.8 security update
    • RHAF Camel-K 1.8
  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2022:1179 Released 2022-04-12 · Red Hat rating Important
    Red Hat support for Spring Boot 2.5.10 update
    • Red Hat Support for Spring Boot 2.5.10
Show 11 more Red Hat advisories
  • RHSA-2022:0146 Released 2022-01-17 · Red Hat rating Moderate
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2 via EAP 7.3.x base
  • RHSA-2021:5170 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.10 security update
    • Red Hat Single Sign-On 7.4.10
  • RHSA-2021:5149 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-apache-cxf-3.3.12-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el6eap +47
  • RHSA-2021:5151 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-apache-cxf-3.3.12-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el8eap +47
  • RHSA-2021:5154 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update
    • EAP 7.3.10 GA
  • RHSA-2021:5150 Released 2021-12-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-apache-cxf-3.3.12-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.3.12-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.3.12-1.redhat_00001.1.el7eap +47
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2021:4677 Released 2021-11-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.7.0-1.redhat_00001.1.el8eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el8eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el8eap +22
  • RHSA-2021:4676 Released 2021-11-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.7.0-1.redhat_00001.1.el7eap, eap7-jsoup-1.14.2-1.redhat_00002.1.el7eap, eap7-resteasy-3.15.2-1.Final_redhat_00001.1.el7eap +24
  • RHSA-2021:4679 Released 2021-11-15 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.2 security update
    • Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.12.Final-redhat-00001.jar, org.apache.santuario.xmlsec-2.1.7.redhat-00001.jar, org.apache.sshd.sshd-core-2.7.0.redhat-00001.jar +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat support for Spring BootAffectedNo fix yet
EAP 7.3.10 GAFixed RHSA-2021:5154
RHAF Camel-K 1.8Fixed RHSA-2022:6407
Red Hat EAP-XP 2 via EAP 7.3.x baseFixed RHSA-2022:0146
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:5151
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:5149
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:5150
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:4676
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:4677
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:4679
Red Hat Single Sign-On 7.4.10Fixed RHSA-2021:5170
Red Hat Support for Spring Boot 2.5.10Fixed RHSA-2022:1179
Not affected: 8 products
  • Red Hat Decision Manager 7
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3629
  2. 2026-10-03 Alias added: GHSA-rf6q-vx79-mjxr

References

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences