Undertow vulnerable to Denial of Service (DoS) attacks

published 2022-07-15 4 y ago modified 2026-06-17 4 mo ago also GHSA-339q-62wm-c39w , EUVD-2022-6212

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Patch / fix

fixed in 2 distros 2 links 4

maven io.undertow:undertow-core 2.2.15
redhat undertow 2.2.15

debian red hat

undertow Debian 14 2.2.16-1

debian advisories DEBIAN-CVE-2021-3859

rh-sso7-keycloak red hat single sign on 7.5 15.0.4-1.redhat_00003.1.el7sso
rh-sso7-keycloak-server red hat single sign on 7.5 15.0.4-1.redhat_00003.1.el7sso
rh-sso7-keycloak red hat single sign on 7.5 15.0.4-1.redhat_00003.1.el8sso
rh-sso7-keycloak-server red hat single sign on 7.5 15.0.4-1.redhat_00003.1.el8sso
eap7-hornetq jboss enterprise application platform 7.4 2.4.8-1.Final_redhat_00001.1.el7eap
eap7-undertow jboss enterprise application platform 7.4 2.2.13-1.SP2_redhat_00001.1.el7eap
eap7-hornetq-commons jboss enterprise application platform 7.4 2.4.8-1.Final_redhat_00001.1.el7eap
eap7-hornetq-jms-client jboss enterprise application platform 7.4 2.4.8-1.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2025:4226 RHSA-2024:10207 RHSA-2022:0447 RHSA-2022:0448 RHSA-2022:0400 RHSA-2022:0401

github.com/undertow-io/undertow@e43f0ad commit
github.com/undertow-io/undertow@db0f5be commit
github.com/undertow-io/undertow#1296 pull request
issues.redhat.com/browse/UNDERTOW-1979 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3859 updated 2026-11-07 cvss 7.5

undertow: client side invocation timeout raised when calling over HTTP2

Red Hat JBoss Data Grid 7 undertow undertow Red Hat JBoss Fuse 6 undertow undertow Red Hat OpenStack Platform 10 (Newton) opendaylight Red Hat OpenStack Platform 13 (Queens) opendaylight
affected: no fix planned “Out of support scope”
Red Hat EAP 7.3 async
fixed: vendor fix RHSA-2022:0406
Red Hat Middleware Containers for OpenShift rh-sso-7/sso74-openshift-rhel8 7.4-44, rh-sso-7/sso75-openshift-rhel8 7.5-16, rh-sso-7/sso7-rhel8-operator-bundle 7.5.1-8, rh-sso-7/sso74-openj9-openshift-rhel8 7.4-59
fixed: vendor fix RHSA-2022:0415
Red Hat Fuse 7.11
fixed: vendor fix RHSA-2022:5532
Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-undertow 2.0.41-2.SP2_redhat_00001.1.el8eap Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-undertow 2.0.41-2.SP2_redhat_00001.1.el6eap Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-undertow 2.0.41-2.SP2_redhat_00001.1.el7eap
fixed: vendor fix RHSA-2022:0405
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-undertow 2.2.13-1.SP2_redhat_00001.1.el7eap
fixed: vendor fix RHSA-2022:0400
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-undertow 2.2.13-1.SP2_redhat_00001.1.el8eap
fixed: vendor fix RHSA-2022:0401
Red Hat JBoss Enterprise Application Platform undertow-core 2.2.13.SP2-redhat-00001
fixed: vendor fix RHSA-2022:0404

show 8 more

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jsoup 1.14.2-1.redhat_00002.1.ep7.el7, eap7-wildfly 7.1.10-2.GA_redhat_00002.1.ep7.el7, eap7-woodstox-core 5.0.3-2.redhat_00002.1.ep7.el7, eap7-xml-security 2.0.10-2.redhat_00002.1.ep7.el7, eap7-undertow 1.4.18-14.SP13_redhat_00001.1.ep7.el7, eap7-artemis-native 1.5.5.016-1.redhat_00001.1.ep7.el7, +19 more
fixed: vendor fix RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-avro 1.7.6-8.redhat_00003.1.el7eap, eap7-wss4j 2.3.3-2.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-38.redhat_00015.1.el7eap, eap7-wildfly 7.3.11-4.GA_redhat_00002.1.el7eap, eap7-h2database 1.4.197-3.redhat_00004.1.el7eap, eap7-wss4j-policy 2.3.3-2.redhat_00001.1.el7eap, +41 more
fixed: vendor fix RHSA-2024:10207
Red Hat Single Sign-On 7.4.10
fixed: vendor fix RHSA-2022:0408
Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak 15.0.4-1.redhat_00003.1.el7sso, rh-sso7-keycloak-server 15.0.4-1.redhat_00003.1.el7sso
fixed: vendor fix RHSA-2022:0447
Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak 15.0.4-1.redhat_00003.1.el8sso, rh-sso7-keycloak-server 15.0.4-1.redhat_00003.1.el8sso
fixed: vendor fix RHSA-2022:0448
Red Hat Support for Spring Boot 2.5.10
fixed: vendor fix RHSA-2022:1179
Red Hat RHSSO 7.5.1
fixed: vendor fix RHSA-2022:0407
Red Hat build of Quarkus undertow undertow Red Hat Decision Manager 7 undertow undertow Red Hat Integration Camel K 1 undertow undertow Red Hat Integration Camel Quarkus 1 undertow undertow Red Hat Integration Service Registry undertow undertow Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.3-5.GA_redhat_00002.1.el7eap, eap7-azure-storage 8.6.6-1.redhat_00001.1.el7eap, eap7-hornetq 2.4.8-1.Final_redhat_00001.1.el7eap, eap7-jgroups 4.2.15-1.Final_redhat_00001.1.el7eap, eap7-resteasy 3.15.3-1.Final_redhat_00001.1.el7eap, eap7-hibernate 5.3.24-1.Final_redhat_00001.1.el7eap, +57 more

+4 more productsfewer

Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.3-5.GA_redhat_00002.1.el8eap, eap7-azure-storage 8.6.6-1.redhat_00001.1.el8eap, eap7-hornetq 2.4.8-1.Final_redhat_00001.1.el8eap, eap7-jgroups 4.2.15-1.Final_redhat_00001.1.el8eap, eap7-resteasy 3.15.3-1.Final_redhat_00001.1.el8eap, eap7-hibernate 5.3.24-1.Final_redhat_00001.1.el8eap, +55 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1452 more Red Hat JBoss Enterprise Application Platform Expansion Pack undertow undertow Red Hat Process Automation 7 undertow undertow

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.74% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	io.undertow:undertow-core	<2.2.15	2.2.15

Affected products

n/a undertow

Classification

Weakness

CWE-214 Invocation of Process Using Visible Sensitive Information
CWE-668 Exposure of Resource to Wrong Sphere
CWE-400 Uncontrolled Resource Consumption

References

github.com /undertow-io/undertow/pull/1296
web, third-party-advisory
github.com /undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
web, patch, third-party-advisory
issues.redhat.com /browse/UNDERTOW-1979
web, issue-tracking, patch, vendor-advisory
github.com /undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8
web
bugzilla.redhat.com /show_bug.cgi?id=2010378
web, issue-tracking, vendor-advisory
access.redhat.com /security/cve/CVE-2021-3859
vendor-advisory
security.netapp.com /advisory/ntap-20221201-0004/
third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-3859
advisory
access.redhat.com /security/cve/cve-2021-3859
web
github.com /undertow-io/undertow
package
security.netapp.com /advisory/ntap-20221201-0004
web

Sources

CVE List CVE-2021-3859
GitHub Advisory GHSA-339q-62wm-c39w
NVD CVE-2021-3859

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary