CVE-2021-3629

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
redhatintegration
-
redhatjboss_enterprise_application_platform
-
redhatsingle_sign-on
-
redhatundertow
𝑥
< 2.0.40
redhatundertow
2.2.0 ≤
𝑥
< 2.2.11
redhatwildfly_core
𝑥
< 17.0
redhatjboss_enterprise_application_platform
7.4
redhatjboss_enterprise_application_platform
7.3
netappactive_iq_unified_manager
-
netappactive_iq_unified_manager
-
netappactive_iq_unified_manager
-
netapponcommand_insight
-
netapponcommand_workflow_automation
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
undertow
sid
2.3.8-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
undertow
noble
needs-triage
mantic
dne
lunar
dne
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
groovy
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne