CVE-2021-3690: Undertow Memory Exhaustion Vulnerability
Summary
CVE-2021-3690: Undertow vulnerable to memory exhaustion due to buffer leak. Affects io.undertow:undertow-core across 2 version ranges.
< 2.0.40
>= 2.2.0, < 2.2.10
Fixed in 2.0.40 or 2.2.10, depending on the release line you run. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2021-3690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a lightweight web server and servlet container designed for high performance and scalability. It is widely used in Java applications to handle HTTP and WebSocket requests. The vulnerability identified as CVE-2021-3690 affects the Undertow core package versions prior to 2.0.40 and 2.2.10. This vulnerability can be exploited through incoming WebSocket PONG messages, leading to a buffer leak and subsequent memory exhaustion. As a result, an attacker can launch a denial of service attack, causing the affected application to become unresponsive or crash.
Vulnerability Detail
The vulnerability arises from a buffer leak in the handling of WebSocket PONG messages in Undertow. When an incoming PONG message is received, the buffer used to store the message payload is not properly released, resulting in a memory leak. This can be exploited by an attacker to send a large number of WebSocket PONG messages, exhausting the available memory and causing a denial of service. The impact of this vulnerability is significant, as it can lead to the complete unavailability of the affected application.
How To Fix
Latest published version: 2.4.4.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.402.0.40 -
>= 2.2.0, < 2.2.102.2.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the Undertow core package is not immediately feasible, a temporary workaround can be implemented. This involves disabling or limiting the use of WebSocket functionality in the affected application. By preventing the processing of WebSocket PONG messages, the vulnerability can be mitigated. However, this workaround may impact the functionality of applications that rely on WebSocket communication.
Conclusion
The CVE-2021-3690 vulnerability in Undertow exposes applications to memory exhaustion attacks through WebSocket PONG messages. It is crucial to promptly update the Undertow core package to the recommended versions or apply the provided workaround to mitigate the risk. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
The vulnerability can lead to memory exhaustion and denial of service, causing the affected application to become unresponsive or crash.
To fix this vulnerability, update the Undertow core package to the recommended versions or apply the provided workaround.
No, only versions prior to 2.0.40 and 2.2.10 are vulnerable. It is important to check the version of Undertow being used in your application.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
