Vulnerability · Published May 24, 2022 · Assigned by redhat
CVE-2021-3597
Medium 5.9
In plain English
A medium-severity race condition in undertow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)1.2%top 32.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | undertow | 2.2.10-1 | DEBIAN-CVE-2021-3597 |
| Maven | io.undertow:undertow-core | 2.2.9.Final | GHSA-mfhv-gwf8-4m88 |
| Maven | io.undertow:undertow-core | 2.0.39.Final | GHSA-mfhv-gwf8-4m88 |
| Ubuntu:25.10 | undertow | no fix listed | UBUNTU-CVE-2021-3597 |
| Ubuntu:26.04:LTS | undertow | no fix listed | UBUNTU-CVE-2021-3597 |
| Ubuntu:26.10 | undertow | no fix listed | UBUNTU-CVE-2021-3597 |
Affected products (as reported)
Weakness: CWE-362
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1970930 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220804-0003/ x_refsource_CONFIRM