Memory Exhaustion Vulnerability in Undertow WebSocket Implementation
Summary
CVE-2021-3690: A flaw was found in Undertow. Affects undertow across 2 version ranges.
< 2.2.10-1
< c7e84a0b7efced38506d7d1dfea5902366973877
Fixed in 2.2.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server and servlet container that is designed for handling high concurrency. It supports both blocking and non-blocking APIs and is widely used in Java applications. This vulnerability affects Undertow's WebSocket implementation, which is responsible for handling real-time communication between clients and servers. The flaw can lead to significant performance issues, particularly under heavy load.
Vulnerability Detail
A flaw was found in Undertow related to a buffer leak on incoming WebSocket PONG messages. This leak can result in memory exhaustion, allowing an attacker to exploit the vulnerability and cause a denial of service (DoS). The vulnerability arises from improper handling of WebSocket messages, leading to excessive memory consumption. The potential ramifications include service unavailability, which can severely impact applications relying on Undertow for real-time communication.
How To Fix
Minimum fixed version
2.2.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade undertowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the number of concurrent WebSocket connections to reduce the impact of this vulnerability. Additionally, monitoring memory usage and implementing rate limiting on WebSocket connections may help mitigate the risk until the patch is applied.
Conclusion
CVE-2021-3690 represents a significant risk to applications using Undertow due to its potential to cause memory exhaustion and denial of service. It is crucial for developers and system administrators to apply the necessary updates and consider workarounds to protect their applications from exploitation.
See every vulnerability recorded for undertow →
FAQ
CVE-2021-3690 is a vulnerability in the Undertow web server that can lead to memory exhaustion due to a buffer leak in the WebSocket PONG message handling.
Exploitation of this vulnerability can result in denial of service, making your application unavailable to users, especially during high traffic periods.
Yes, a patched version of Undertow is available. Users should update to version 2.2.10-1 or later to mitigate the vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for undertow.
