PT-2022-10597 · Undertow · Undertow

Andrew Marinchuk · Published 2022-07-15 · Updated 2024-11-08 · CVE-2021-3690

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.0.40 Undertow versions prior to 2.2.10

Description A flaw was found in Undertow, where a buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion, allowing an attacker to cause a denial of service. The highest threat from this issue is availability.

Recommendations For Undertow versions prior to 2.0.40, update to version 2.0.40 or later to resolve the issue. For Undertow versions prior to 2.2.10, update to version 2.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to WebSocket PONG messages to minimize the risk of exploitation.

Exploit

Fix

DoS

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-401

CWE-400

Related Identifiers

CVE-2021-3690

GHSA-FJ7C-VG2V-CCRM

OESA-2024-2353

RHSA-2021:3217

RHSA-2021:3219

RHSA-2021:3466

RHSA-2021:3467

RHSA-2021:3468

RHSA-2021:3656

RHSA-2021:3658

RHSA-2025:4226

Affected Products

Undertow

References · 19

• 🔥 https://issues.redhat.com/browse/UNDERTOW-1935 · Exploit
• https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3690 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3690 · Security Note
• https://access.redhat.com/security/cve/CVE-2021-3690 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3690 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5379 · Security Note
• https://osv.dev/vulnerability/GHSA-fj7c-vg2v-ccrm · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3690 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2353 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3690 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3690 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1991299 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3690 · Vendor Advisory
• https://github.com/undertow-io/undertow · Note