CVE-2021-3629: Undertow Uncontrolled Resource Consumption
Summary
CVE-2021-3629: Undertow Uncontrolled Resource Consumption. Affects io.undertow:undertow-core across 2 version ranges.
< 2.0.40.Final
>= 2.1.0, < 2.2.11.Final
Fixed in 2.0.40.Final or 2.2.11.Final, depending on the release line you run. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2021-3629 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a lightweight web server written in Java that is used to create high-performance web applications. It provides a flexible and efficient framework for handling HTTP requests and responses. Undertow is widely used in various Java-based web applications and frameworks. However, versions prior to 2.0.40.Final and 2.2.11.Final are vulnerable to an uncontrolled resource consumption issue.
Vulnerability Detail
The vulnerability in Undertow is related to flow control handling by the browser over HTTP/2. This flaw can potentially cause overhead or a denial of service in the server. An attacker could exploit this vulnerability to exhaust server resources, leading to a loss of availability. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 2.4.4.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.40.Final2.0.40.Final -
>= 2.1.0, < 2.2.11.Final2.2.11.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of Undertow.
Conclusion
Undertow versions prior to 2.0.40.Final and 2.2.11.Final are vulnerable to an uncontrolled resource consumption issue. This vulnerability can be fixed by upgrading to the recommended secure versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
Undertow is a lightweight web server written in Java that provides a flexible and efficient framework for handling HTTP requests and responses.
The vulnerability can lead to uncontrolled resource consumption, potentially causing a denial of service or server overhead.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, upgrade Undertow to version 2.0.40.Final or later if using versions prior to 2.0.40.Final. For versions 2.1.0 and later, upgrade to version 2.2.11.Final or later.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions of Undertow.
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
