Homepage

io.undertow:undertow-core@2.2.2.Final vulnerabilities

  • latest version

    2.3.20.Final

  • latest non vulnerable version

    2.4.0.Alpha1

  • first published

    12 years ago

  • latest version published

    19 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the io.undertow:undertow-core package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Allocation of Resources Without Limits or Throttling (MadeYouReset)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling (MadeYouReset) through malformed client requests that trigger repeated server-side stream resets without incrementing abuse counters. An attacker can exhaust server resources by sending specially crafted HTTP/2 requests that cause excessive workload through repeated stream aborts.

    How to fix Allocation of Resources Without Limits or Throttling (MadeYouReset)?

    Upgrade io.undertow:undertow-core to version 2.3.20.Final or higher.

    [0,2.3.20.Final)
    • H
    Memory Allocation with Excessive Size Value

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to improper @MultipartConfig annotation handling for very large multipart content.

    Note: If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

    How to fix Memory Allocation with Excessive Size Value?

    Upgrade io.undertow:undertow-core to version 2.2.27.Final, 2.3.9.Final or higher.

    [,2.2.27.Final)[2.3.0.Alpha1,2.3.9.Final)
    • C
    HTTP Request Smuggling

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interaction of quotation marks and delimiters in the parseCookie() function. An attacker can exfiltrate HttpOnly cookie values or smuggle extra cookie values.

    How to fix HTTP Request Smuggling?

    Upgrade io.undertow:undertow-core to version 2.2.30.Final, 2.3.11.Final or higher.

    [,2.2.30.Final)[2.3.0.Alpha1,2.3.11.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) through the wildfly-http-client protocol, due to the WriteTimeoutStreamSinkConduit process. This vulnerability can be exploited by repeatedly opening and closing connections immediately, which triggers memory and file descriptor leaks.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.31.Final, 2.3.12.Final or higher.

    [,2.2.31.Final)[2.3.0.Final,2.3.12.Final)
    • M
    Race Condition

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Race Condition due to the reuse of the StringBuilder instance in the ProxyProtocolReadListener across multiple requests. An attacker can access data from previous requests or responses by exploiting the shared usage of the StringBuilder.

    This vulnerability primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.

    How to fix Race Condition?

    Upgrade io.undertow:undertow-core to version 2.2.36.Final, 2.3.17.Final or higher.

    [,2.2.36.Final)[2.3.0.Alpha1,2.3.17.Final)
    • L
    Memory Leak

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Memory Leak when the learning-push handler is configured with the default maxAge of -1. An attacker who can send normal HTTP requests may consume excessive memory.

    How to fix Memory Leak?

    Upgrade io.undertow:undertow-core to version 2.2.37.Final, 2.3.18.Final or higher.

    [,2.2.37.Final)[2.3.0.Alpha1,2.3.18.Final)
    • H
    Uncontrolled Recursion

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Uncontrolled Recursion in chunked response handling. An attacker can cause a client to wait indefinitely by sending excessive data without a 0\r\n termination sequence in chunked responses, thereby disrupting service to the server.

    Note: This is only exploitable when using NewSessionTicket functionality in TLS 1.3 on Java 17.

    How to fix Uncontrolled Recursion?

    Upgrade io.undertow:undertow-core to version 2.2.34.Final, 2.3.8.Final or higher.

    [,2.2.34.Final)[2.3.0.Final,2.3.8.Final)
    • M
    Directory Traversal

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Directory Traversal due to improper input validation of the HTTP request. An attacker can access privileged or restricted files and directories by appending a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP.

    How to fix Directory Traversal?

    Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.12.Final or higher.

    [,2.2.33.Final)[2.3.0.Final,2.3.12.Final)
    • H
    Uncontrolled Resource Consumption ('Resource Exhaustion')

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') through the handling of URL-encoded request path information on ajp-listener. An attacker can cause the server to process incorrect paths, leading to a disruption of service by sending specially crafted concurrent requests.

    How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

    Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.14.Final or higher.

    [,2.2.33.Final)[2.3.0.Final,2.3.14.Final)
    • H
    Uncontrolled Resource Consumption ('Resource Exhaustion')

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to insufficient limitations on the amount of CONTINUATION frames that can be sent within a single stream. An attacker can use up compute or memory resources to cause a disruption in service by sending packets to vulnerable servers.

    How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

    Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.14.Final or higher.

    [,2.2.33.Final)[2.3.0.Final,2.3.14.Final)
    • H
    Allocation of Resources Without Limits or Throttling

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can disrupt service availability by repeatedly sending AJP requests that exceed the configured max-header-size attribute in ajp-listener, leading to the server closing the TCP connection without returning an AJP response.

    Note:

    This is only exploitable if the max-header-size is set to 64 KB or less.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade io.undertow:undertow-core to version 2.2.31.Final, 2.3.12.Final or higher.

    [,2.2.31.Final)[2.3.0.Alpha1,2.3.12.Final)
    • H
    Improper Input Validation

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Improper Input Validation via the FormAuthenticationMechanism. An attacker can exhaust the server's memory, leading to a Denial of Service by sending crafted requests that cause an OutofMemory error.

    How to fix Improper Input Validation?

    Upgrade io.undertow:undertow-core to version 2.2.32.Final, 2.3.13.Final or higher.

    [,2.2.32.Final)[2.3.0.Alpha1,2.3.13.Final)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) in flow control handling by the browser over HTTP/2. This may cause overhead or a denial of service in the server. This is due to an incomplete fix of CVE-2021-3629.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.25.Final, 2.3.6.Final or higher.

    [0,2.2.25.Final)[2.3.0.Alpha1,2.3.6.Final)
    • H
    Improper Certificate Validation

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Improper Certificate Validation via the undertow client which does not check the server identity presented by the server certificate in https connections.

    How to fix Improper Certificate Validation?

    Upgrade io.undertow:undertow-core to version 2.2.24.Final, 2.3.5.Final or higher.

    [0,2.2.24.Final)[2.3.0.Alpha1,2.3.5.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) via an AJP 400 response, when EAP 7 is improperly sending two response packets, those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.18, 2.3.0.Alpha2 or higher.

    [,2.2.18)[2.3.0.Alpha1,2.3.0.Alpha2)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) when a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize). The AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy which will result in a front-end proxy marking the backend worker as an error state and not forward requests to the worker for a while.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.19.Final, 2.3.0.Alpha2 or higher.

    [,2.2.19.Final)[2.3.0.Alpha1,2.3.0.Alpha2)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) due to an issue in the flow control handling by the browser over http/2.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.0.40.Final, 2.2.11.Final or higher.

    [,2.0.40.Final)[2.1.0.Final,2.2.11.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) which would cause client side invocation timeout with certain calls made over HTTP2.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.15.Final or higher.

    [0,2.2.15.Final)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) due to final frame write failure in HTTP2SourceChannel under certain circumstances.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.8.Final or higher.

    [0,2.2.8.Final)
    Go back to all versions of this package