p PatchFirst

CVE-2021-3597

CVE-2021-3597

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

CVSS 5.9 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • undertow

    Versions
    • undertow 2.0.35.SP1, undertow 2.2.6.SP1, undertow 2.2.7.SP1, undertow 2.0.36.SP1, undertow 2.2.9.Final, undertow 2.0.39.Final: Affected

    No fix published

  • undertow Debian:14

    Versions
    • 1.3.11-1
    • 1.3.16-1
    • 1.3.19-1
    • 1.3.21-1
    • 1.3.23-1
    • 1.3.4-1
    • 1.3.5-1
    • 1.3.7-1
    • 1.4.0-1
    • 1.4.1-1
    • 1.4.18-1
    • 1.4.20-1
    • 1.4.21-1
    • 1.4.21-2
    • 1.4.22-1
    • 1.4.23-1
    • 1.4.23-2
    • 1.4.23-3
    • 1.4.25-1
    • 1.4.25-2
    • 1.4.3-1
    • 1.4.4-1
    • 1.4.6-1
    • 1.4.7-1
    • 1.4.8-1
    • 2.0.23-1
    • 2.0.25-1
    • 2.0.26-1
    • 2.0.27-1
    • 2.0.28-1
    • 2.0.29-1
    • 2.0.30-1
    • 2.1.0-1
    • 2.1.1-1
    • 2.1.3-1
    • 2.2.0-1
    • 2.2.2-1
    • 2.2.3-1
    • 2.2.4-1
    • 2.2.5-1
    • 2.2.8-1
    Affected ranges
    • ECOSYSTEM: < 2.2.10-1

    Update to 2.2.10-1

  • undertow Ubuntu:Pro:16.04:LTS

    Versions
    • 1.3.4-1
    • 1.3.5-1
    • 1.3.7-1
    • 1.3.11-1
    • 1.3.16-1
    • 1.3.16-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • undertow Ubuntu:Pro:18.04:LTS

    Versions
    • 1.4.20-1
    • 1.4.21-1
    • 1.4.22-1
    • 1.4.23-1
    • 1.4.23-2build1
    • 1.4.23-3
    • 1.4.23-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • undertow Ubuntu:Pro:20.04:LTS

    Versions
    • 2.0.23-1
    • 2.0.27-1
    • 2.0.28-1
    • 2.0.29-1
    • 2.0.29-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • undertow Ubuntu:Pro:22.04:LTS

    Versions
    • 2.2.8-1
    • 2.2.12-1
    • 2.2.13-1
    • 2.2.14-1
    • 2.2.16-1
    • 2.2.16-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • undertow Ubuntu:Pro:24.04:LTS

    Versions
    • 2.3.8-2
    • 2.3.8-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • undertow Ubuntu:25.10

    Versions
    • 2.3.18-1
    • 2.3.18-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • undertow Ubuntu:26.10

    Versions
    • 2.3.20-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • undertow Ubuntu:26.04:LTS

    Versions
    • 2.3.18-2
    • 2.3.20-1
    • 2.3.20-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →