GHSA-xpp6-8r3j-ww43
Undertow Denial of Service vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2024-5971
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected `0\r\n` termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.
Affected packages
| Package | Versions |
|---|---|
| Maven · io.undertow:undertow-core | introduced 2.3.0.Alpha1, fixed 2.3.15.Final |
| Maven · io.undertow:undertow-core | introduced 0, fixed 2.2.34.Final |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-5971 ADVISORY
- https://github.com/undertow-io/undertow/pull/1638 WEB
- https://github.com/undertow-io/undertow/pull/1640 WEB
- https://github.com/undertow-io/undertow/pull/1641 WEB
- https://access.redhat.com/errata/RHSA-2024:4392 WEB
- https://access.redhat.com/errata/RHSA-2024:4884 WEB
- https://access.redhat.com/errata/RHSA-2024:5143 WEB
- https://access.redhat.com/errata/RHSA-2024:5144 WEB
- https://access.redhat.com/errata/RHSA-2024:5145 WEB
- https://access.redhat.com/errata/RHSA-2024:5147 WEB
- https://access.redhat.com/errata/RHSA-2024:6508 WEB
- https://access.redhat.com/errata/RHSA-2024:6883 WEB
- https://access.redhat.com/security/cve/CVE-2024-5971 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2292211 WEB
- https://github.com/undertow-io/undertow PACKAGE
- https://issues.redhat.com/browse/UNDERTOW-2413 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |