CVE-2021-3597
undertow Race Condition vulnerability
5.9
MEDIUM
CVSS 3.1
EPSS 0.17%
Description
A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
How to fix CVE-2021-3597
To remediate CVE-2021-3597, upgrade the affected package to a fixed version below.
- —upgrade to 2.2.10-1 or later
- —upgrade to 2.2.9.Final or later
Is CVE-2021-3597 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.2.10-1
- >= 2.1.0, < 2.2.9.Final
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |