Denial of Service Risk in Undertow Package Due to HTTP/2 Flow Control Handling
Summary
CVE-2021-3629: A flaw was found in Undertow. Affects undertow across 3 version ranges.
< 2.2.12-1
< 38f40e77f5284243a5f469faf7e7165b857aa68e
< 225d62735b189e460a56460207b8c6073fcc3737
Fixed in 2.2.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server designed for handling HTTP requests and responses. It is widely used in Java applications for its lightweight architecture and ability to support both blocking and non-blocking APIs. However, a flaw in its flow control handling over HTTP/2 can lead to potential denial of service, affecting the availability of applications relying on this package.
Vulnerability Detail
A flaw was found in Undertow related to the handling of flow control in HTTP/2. This vulnerability can be exploited by an attacker to cause excessive overhead on the server, potentially leading to a denial of service. The issue arises from improper management of flow control, which can overwhelm server resources, making it unavailable to legitimate users. The vulnerability affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
How To Fix
Minimum fixed version
2.2.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade undertowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the number of concurrent HTTP/2 connections or implementing rate limiting on your server to mitigate the impact of this vulnerability until a patch can be applied.
Conclusion
The CVE-2021-3629 vulnerability in the Undertow package poses a significant risk of denial of service due to improper handling of HTTP/2 flow control. It is crucial for users to update to the patched versions to ensure the security and availability of their applications. Temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for undertow →
FAQ
CVE-2021-3629 is a vulnerability in the Undertow package that can lead to denial of service due to improper flow control handling in HTTP/2.
Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
If immediate updates are not possible, consider implementing rate limiting or restricting concurrent connections to reduce the risk of denial of service.
Related vulnerabilities
Recent vulnerabilities recorded for undertow.
