Denial of Service Vulnerability in Undertow: HTTP2SourceChannel Final Frame Issue
Summary
CVE-2021-3597: A flaw was found in undertow. Affects undertow across 3 version ranges.
< 2.2.10-1
< 7aa46956d0171a36f39521a7b3065a8c4b8d9ad2
< d48d5f7b6084ec71aeb1d5a1203431b0396b0e01
Fixed in 2.2.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server written in Java, designed to support both blocking and non-blocking APIs. It is widely used for building web applications and microservices due to its lightweight nature and ease of integration with other frameworks. However, a flaw has been identified in the HTTP2SourceChannel component, which can lead to denial of service under specific conditions.
Vulnerability Detail
A flaw was found in Undertow where the HTTP2SourceChannel fails to write the final frame under certain circumstances. This issue can result in a denial of service, impacting the availability of applications relying on this web server. The vulnerability affects multiple versions of Undertow, specifically those prior to 2.0.35.SP1, 2.2.6.SP1, 2.2.7.SP1, 2.0.36.SP1, 2.2.9.Final, and 2.0.39.Final. The CVSS score for this vulnerability is 5.9, indicating a moderate threat level.
How To Fix
Minimum fixed version
2.2.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade undertowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing a reverse proxy in front of Undertow to mitigate the effects of this vulnerability. This can help manage traffic and reduce the risk of denial of service.
Conclusion
The CVE-2021-3597 vulnerability in Undertow poses a significant risk of denial of service, affecting various versions of the package. It is crucial to update to the latest patched versions to ensure the security and availability of your applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for undertow →
FAQ
The impact is a denial of service, which means that users may experience downtime or unavailability of services relying on Undertow.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 2.0.35.SP1, 2.2.6.SP1, 2.2.7.SP1, 2.0.36.SP1, 2.2.9.Final, and 2.0.39.Final are affected by this vulnerability.
The CVSS score for CVE-2021-3597 is 5.9, indicating a moderate severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for undertow.
