CVE-2021-3690

undertow: buffer leak on incoming websocket PONG message may lead to DoS

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Se ha encontrado un fallo en Undertow. Un filtrado de búfer en el mensaje entrante de WebSocket PONG puede conllevar a el agotamiento de la memoria. Este fallo permite a un atacante causar una denegación de servicio. La mayor amenaza de esta vulnerabilidad es la disponibilidad.

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.1 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.0 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.1 Release Notes for information about the most significant bug fixes and enhancements included in this release. Issues addressed include code execution, cross site scripting, denial of service, and traversal vulnerabilities.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-08-09 CVE Reserved
2021-08-19 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC
https://issues.redhat.com/browse/UNDERTOW-1935	2024-08-03

URL	Date	SRC
https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877	2023-07-07

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2021-3690	2022-03-23
https://bugzilla.redhat.com/show_bug.cgi?id=1991299	2022-03-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.3 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.3"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.3 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.3"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.3 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.3"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.4 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.4"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	7.0 Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"	-	Safe
Redhat Search vendor "Redhat"	Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"	7.4 Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.4"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"	-	Safe
Redhat Search vendor "Redhat"		Fuse Search vendor "Redhat" for product "Fuse"				1.0 Search vendor "Redhat" for product "Fuse" and version "1.0"		-		Affected
Redhat Search vendor "Redhat"		Integration Camel K Search vendor "Redhat" for product "Integration Camel K"				-		-		Affected
Redhat Search vendor "Redhat"		Integration Camel Quarkus Search vendor "Redhat" for product "Integration Camel Quarkus"				-		-		Affected
Redhat Search vendor "Redhat"		Jboss Enterprise Application Platform Search vendor "Redhat" for product "Jboss Enterprise Application Platform"				-		text-only		Affected
Redhat Search vendor "Redhat"		Openshift Application Runtimes Search vendor "Redhat" for product "Openshift Application Runtimes"				-		text-only		Affected
Redhat Search vendor "Redhat"		Single Sign-on Search vendor "Redhat" for product "Single Sign-on"				-		text-only		Affected
Redhat Search vendor "Redhat"		Undertow Search vendor "Redhat" for product "Undertow"				< 2.0.40 Search vendor "Redhat" for product "Undertow" and version " < 2.0.40"		-		Affected
Redhat Search vendor "Redhat"		Undertow Search vendor "Redhat" for product "Undertow"				>= 2.1.0 < 2.2.10 Search vendor "Redhat" for product "Undertow" and version " >= 2.1.0 < 2.2.10"		-		Affected