Read the docs
TI-2021-02790 Aliases CVE-2021-3859GHSA-339q-62wm-c39w

Exposure of resource to wrong sphere in undertow

Priority LOW 36CWE-214Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-668 and the CVSS impact.

Summary

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Why it matters now

EPSS 0.01736 77th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.2.15Red Hat: 16 advisoriesRed Hat: 16 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—undertowFixed in 2.2.15.Final—No fix listedCNA
—io.undertow:undertow-core (Maven)before 2.2.152.2.15Patch availableGHSA-339q-62wm-c39w
  • undertow Vendor— Affected Fixed in 2.2.15.Final Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.15 Fixed in 2.2.15 Patch available GHSA-339q-62wm-c39w

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.4.10:*:*:*:*:*:*:*7.4.10VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.5.1:*:*:*:*:*:*:*7.5.1VulnerableRed Hat
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.2.15VulnerableRed Hat
cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.4.10:*:*:*:*:*:*:* Versions 7.4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.5.1:*:*:*:*:*:*:* Versions 7.5.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.2.15 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-339q-62wm-c39w io.undertow:undertow-core (Maven) Fixed in 2.2.15 Advisory →

Red Hat 16 advisories

  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2024:10207 Released 2024-11-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.11 Security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.4.10-1.SP1_redhat_00001.1.el7eap +44
  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
Show 13 more Red Hat advisories
  • RHSA-2022:1179 Released 2022-04-12 · Red Hat rating Important
    Red Hat support for Spring Boot 2.5.10 update
    • Red Hat Support for Spring Boot 2.5.10
  • RHSA-2022:0447 Released 2022-02-07 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update on RHEL 7
    • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.4-1.redhat_00003.1.el7sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00003.1.el7sso
  • RHSA-2022:0448 Released 2022-02-07 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update on RHEL 8
    • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.4-1.redhat_00003.1.el8sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00003.1.el8sso
  • RHSA-2022:0415 Released 2022-02-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso7-rhel8-operator-bundle, rh-sso-7/sso75-openshift-rhel8
  • RHSA-2022:0410 Released 2022-02-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.10 on OpenJ9 for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso74-openj9-openshift-rhel8
  • RHSA-2022:0409 Released 2022-02-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.10 on OpenJDK for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso74-openshift-rhel8
  • RHSA-2022:0408 Released 2022-02-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.10 security update
    • Red Hat Single Sign-On 7.4.10
  • RHSA-2022:0407 Released 2022-02-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update
    • RHSSO 7.5.1
  • RHSA-2022:0401 Released 2022-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.3 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hornetq-2.4.8-1.Final_redhat_00001.1.el8eap, eap7-hornetq-commons-2.4.8-1.Final_redhat_00001.1.el8eap, eap7-hornetq-core-client-2.4.8-1.Final_redhat_00001.1.el8eap +2
  • RHSA-2022:0405 Released 2022-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-undertow-2.0.41-2.SP2_redhat_00001.1.el8eap
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-undertow-2.0.41-2.SP2_redhat_00001.1.el6eap
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-undertow-2.0.41-2.SP2_redhat_00001.1.el7eap
  • RHSA-2022:0406 Released 2022-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • EAP 7.3 async
  • RHSA-2022:0404 Released 2022-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.3 security update
    • Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.13.SP2-redhat-00001.jar, org.hornetq.hornetq-jms-client-2.4.8.Final-redhat-00001.jar
  • RHSA-2022:0400 Released 2022-02-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.3 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hornetq-2.4.8-1.Final_redhat_00001.1.el7eap, eap7-hornetq-commons-2.4.8-1.Final_redhat_00001.1.el7eap, eap7-hornetq-core-client-2.4.8-1.Final_redhat_00001.1.el7eap +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
EAP 7.3 asyncFixed RHSA-2022:0406
Middleware Containers for OpenShiftFixed RHSA-2022:0409, RHSA-2022:0410, RHSA-2022:0415
RHSSO 7.5.1Fixed RHSA-2022:0407
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2022:0405
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2022:0405
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2022:0405
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:0400
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:0401
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:0404
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2024:10207
Red Hat Single Sign-On 7.4.10Fixed RHSA-2022:0408
Red Hat Single Sign-On 7.5 for RHEL 7 ServerFixed RHSA-2022:0447
Red Hat Single Sign-On 7.5 for RHEL 8Fixed RHSA-2022:0448
Red Hat Support for Spring Boot 2.5.10Fixed RHSA-2022:1179
Not affected: 10 products
  • Red Hat Decision Manager 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3859
  2. 2026-10-03 Alias added: GHSA-339q-62wm-c39w

References

Patch 2

Advisory 5

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences