CVE-2021-3690

Aliases:GHSA-fj7c-vg2v-ccrm
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 23 Aug 2022, 15:50
Last modified:03 Aug 2024, 17:01

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.28% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

23 Aug 2022, 15:50
Published
Vulnerability first disclosed
03 Aug 2024, 17:01
Last Modified
Vulnerability information updated

Description

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.28%• Percentile: 51%

Techniques & Countermeasures

  • CWE-401•Missing Release of Memory after Effective Lifetime

    The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • io.undertow•undertow-core

    < 2.0.40 | ≥ 2.2.0, < 2.2.10

  • redhat•fuse

    1.0

  • redhat•integration_camel_k

    na

  • redhat•integration_camel_quarkus

    na

  • redhat•jboss_enterprise_application_platform

    na | 7.3 | 7.4

  • redhat•openshift_application_runtimes

    na

  • redhat•single_sign-on

    na

  • redhat•undertow

    < 2.0.40 | ≥ 2.1.0, < 2.2.10

References (8)