Read the docs
TI-2021-02626 Aliases CVE-2021-3690GHSA-fj7c-vg2v-ccrm

Uncontrolled resource consumption in undertow

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 15 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Why it matters now

EPSS 0.01774 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial io.undertow:undertow-core (Maven): 2.0.40, 2.2.10Red Hat: 18 advisoriesRed Hat: 15 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—undertowFixed in 2.2.10.Final, 2.0.40.Final—No fix listedCNA
—io.undertow:undertow-core (Maven)before 2.0.402.0.40Patch availableGHSA-fj7c-vg2v-ccrm
—io.undertow:undertow-core (Maven)2.2.0 to before 2.2.102.2.10Patch availableGHSA-fj7c-vg2v-ccrm
  • undertow Vendor— Affected Fixed in 2.2.10.Final, 2.0.40.Final Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.0.40 Fixed in 2.0.40 Patch available GHSA-fj7c-vg2v-ccrm
  • io.undertow:undertow-core (Maven) Vendor— Affected 2.2.0 to before 2.2.10 Fixed in 2.2.10 Patch available GHSA-fj7c-vg2v-ccrm

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.0.40; 2.1.0 to before 2.2.10VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
  • cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.0.40; 2.1.0 to before 2.2.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-fj7c-vg2v-ccrm io.undertow:undertow-core (Maven) Fixed in 2.0.40 Advisory →
  • Fix · GHSA-fj7c-vg2v-ccrm io.undertow:undertow-core (Maven) Fixed in 2.2.10 Advisory →

Red Hat 18 advisories

  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2022:1029 Released 2022-03-23 · Red Hat rating Important
    Red Hat Integration Camel-K 1.6.4 release and security update
    • RHINT Camel-K 1.6.4
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
Show 15 more Red Hat advisories
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2021:3660 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update
    • Red Hat JBoss Enterprise Application Platform commons-io.commons-io-2.10.0.redhat-00001.jar, io.netty.netty-all-4.1.63.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.9.SP1-redhat-00001.jar +5
  • RHSA-2021:3658 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
  • RHSA-2021:3656 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap +11
  • RHSA-2021:3534 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update
    • Red Hat Single Sign-On 7.4.9
  • RHSA-2021:3516 Released 2021-09-13 · Red Hat rating Important
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
  • RHSA-2021:3425 Released 2021-09-09 · Red Hat rating Important
    Red Hat support for Spring Boot 2.3.10 security update
    • Red Hat support for Spring Boot 2.3.10
  • RHSA-2021:3468 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el8eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el8eap +47
  • RHSA-2021:3467 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el7eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el7eap +47
  • RHSA-2021:3466 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el6eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el6eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el6eap +47
  • RHSA-2021:3471 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update
    • EAP 7.3.9 release
  • RHSA-2021:3219 Released 2021-08-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-undertow-2.2.5-2.SP1_redhat_00001.1.el7eap
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-undertow-2.2.5-2.SP1_redhat_00001.1.el8eap
  • RHSA-2021:3217 Released 2021-08-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-undertow-2.0.38-2.SP2_redhat_00001.1.el8eap
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-undertow-2.0.38-2.SP2_redhat_00001.1.el6eap
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-undertow-2.0.38-2.SP2_redhat_00001.1.el7eap
  • RHSA-2021:3218 Released 2021-08-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4 security update
    • Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.5.Final-redhat-00001.jar
  • RHSA-2021:3216 Released 2021-08-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • EAP 7.3 async

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
EAP 7.3 asyncFixed RHSA-2021:3216
EAP 7.3.9 releaseFixed RHSA-2021:3471
RHINT Camel-K 1.6.4Fixed RHSA-2022:1029
Red Hat EAP-XP 2.0.0 via EAP 7.3.x baseFixed RHSA-2021:3516
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:3217, RHSA-2021:3468
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:3217, RHSA-2021:3466
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:3217, RHSA-2021:3467
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:3219, RHSA-2021:3656
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:3219, RHSA-2021:3658
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:3218, RHSA-2021:3660
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat Single Sign-On 7.4.9Fixed RHSA-2021:3534
Red Hat support for Spring Boot 2.3.10Fixed RHSA-2021:3425
Not affected: 7 products
  • Red Hat Decision Manager 7
  • Red Hat Integration Service Registry
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Process Automation 7
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3690
  2. 2026-10-03 Alias added: GHSA-fj7c-vg2v-ccrm

References

Exploit 1

Patch 1

Advisory 3

Other 3

  • TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences