Allocation of Resources Without Limits or Throttling in Undertow

published 2020-06-10 6 y ago modified 2026-06-17 4 mo ago also GHSA-g4cp-h53p-v3v8 , EUVD-2021-0822

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits: 0; none known

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

Patch / fix

fixed in 2 distros 2

maven io.undertow:undertow-core 2.1.1.Final
redhat undertow 2.1.1

debian red hat

undertow Debian 14 2.1.1-1

debian advisories DEBIAN-CVE-2020-10705

eap7-txw2 jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
eap7-xsom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
eap7-rngom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
eap7-wss4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.2.5-1.redhat_00001.1.el7eap
eap7-jandex jboss enterprise application platform 7.3 2.1.2-1.Final_redhat_00001.1.el7eap
eap7-jasypt jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 1.9.3-1.redhat_00001.1.el7eap
eap7-wildfly jboss enterprise application platform 7.3 7.3.1-5.GA_redhat_00003.1.el7eap
eap7-jaxb-jxc jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap

red hat advisories RHSA-2025:16668 RHSA-2020:2512 RHSA-2020:2511 RHSA-2020:2513 RHSA-2020:2060 RHSA-2020:2059

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10705 updated 2026-11-05 cvss 7.5

undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header

Red Hat OpenShift Application Runtimes undertow undertow
affected: workaround, no fix available “There is currently no known mitigation for this security flaw.”
Red Hat EAP-CD 20 Tech Preview
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:3585
Red Hat JBoss EAP 7.2
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2061
Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el6eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el6eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el6eap, +152 more
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2058
Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el7eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el7eap, +154 more
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2059
Red Hat JBoss EAP 7.2 for RHEL 8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el8eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el8eap, +152 more
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2060
Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el8eap, +194 more
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2513
Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el6eap, +194 more
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2511

show 5 more

Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el7eap, +196 more
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2512
Red Hat JBoss Enterprise Application Platform 7
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2515
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.12-2.GA_redhat_00002.1.ep7.el7, eap7-hornetq 2.4.11-1.Final_redhat_00001.1.ep7.el7, eap7-undertow 1.4.18-17.SP15_redhat_00001.1.ep7.el7, eap7-wildfly-modules 7.1.12-2.GA_redhat_00002.1.ep7.el7, eap7-hornetq-commons 2.4.11-1.Final_redhat_00001.1.ep7.el7, eap7-hibernate-validator 5.3.6-1.SP1_redhat_00001.1.ep7.el7, +4 more
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2025:16668
Red Hat Text-Only RHOAR
fixed: vendor fix “There is currently no known mitigation for this security flaw.” RHSA-2020:2905
Red Hat Decision Manager 7 undertow undertow Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb Red Hat Process Automation 7 undertow undertow
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.47% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	io.undertow:undertow-core	<2.1.1.Final	2.1.1.Final

Affected products

n/a Undertow

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

bugzilla.redhat.com /show_bug.cgi?id=1803241
web, issue-tracking, vendor-advisory
security.netapp.com /advisory/ntap-20220210-0014/
third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-10705
advisory
security.netapp.com /advisory/ntap-20220210-0014
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary