Homepage
About Snyk

io.undertow:undertow-core@2.3.6.Final vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the io.undertow:undertow-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Denial of Service (DoS)

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Denial of Service (DoS) through the wildfly-http-client protocol, due to the WriteTimeoutStreamSinkConduit process. This vulnerability can be exploited by repeatedly opening and closing connections immediately, which triggers memory and file descriptor leaks.

How to fix Denial of Service (DoS)?

Upgrade io.undertow:undertow-core to version 2.2.31.Final, 2.3.12.Final or higher.

[,2.2.31.Final) [2.3.0.Final,2.3.12.Final)
  • M
Race Condition

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Race Condition due to the reuse of the StringBuilder instance in the ProxyProtocolReadListener across multiple requests. An attacker can access data from previous requests or responses by exploiting the shared usage of the StringBuilder.

This vulnerability primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.

How to fix Race Condition?

Upgrade io.undertow:undertow-core to version 2.2.36.Final, 2.3.17.Final or higher.

[,2.2.36.Final) [2.3.0.Alpha1,2.3.17.Final)
  • L
Memory Leak

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Memory Leak when the learning-push handler is configured with the default maxAge of -1. An attacker who can send normal HTTP requests may consume excessive memory.

How to fix Memory Leak?

Upgrade io.undertow:undertow-core to version 2.2.37.Final, 2.3.18.Final or higher.

[,2.2.37.Final) [2.3.0.Alpha1,2.3.18.Final)
  • H
Uncontrolled Recursion

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Uncontrolled Recursion in chunked response handling. An attacker can cause a client to wait indefinitely by sending excessive data without a 0\r\n termination sequence in chunked responses, thereby disrupting service to the server.

Note: This is only exploitable when using NewSessionTicket functionality in TLS 1.3 on Java 17.

How to fix Uncontrolled Recursion?

Upgrade io.undertow:undertow-core to version 2.2.34.Final, 2.3.8.Final or higher.

[,2.2.34.Final) [2.3.0.Final,2.3.8.Final)
  • M
Directory Traversal

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Directory Traversal due to improper input validation of the HTTP request. An attacker can access privileged or restricted files and directories by appending a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP.

How to fix Directory Traversal?

Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.12.Final or higher.

[,2.2.33.Final) [2.3.0.Final,2.3.12.Final)
  • H
Uncontrolled Resource Consumption

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption through the handling of URL-encoded request path information on ajp-listener. An attacker can cause the server to process incorrect paths, leading to a disruption of service by sending specially crafted concurrent requests.

How to fix Uncontrolled Resource Consumption?

Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.14.Final or higher.

[,2.2.33.Final) [2.3.0.Final,2.3.14.Final)
  • H
Uncontrolled Resource Consumption ('Resource Exhaustion')

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to insufficient limitations on the amount of CONTINUATION frames that can be sent within a single stream. An attacker can use up compute or memory resources to cause a disruption in service by sending packets to vulnerable servers.

How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.14.Final or higher.

[,2.2.33.Final) [2.3.0.Final,2.3.14.Final)
  • H
Allocation of Resources Without Limits or Throttling

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can disrupt service availability by repeatedly sending AJP requests that exceed the configured max-header-size attribute in ajp-listener, leading to the server closing the TCP connection without returning an AJP response.

Note:

This is only exploitable if the max-header-size is set to 64 KB or less.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.undertow:undertow-core to version 2.2.31.Final, 2.3.12.Final or higher.

[,2.2.31.Final) [2.3.0.Alpha1,2.3.12.Final)
  • H
Improper Input Validation

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Improper Input Validation via the FormAuthenticationMechanism. An attacker can exhaust the server's memory, leading to a Denial of Service by sending crafted requests that cause an OutofMemory error.

How to fix Improper Input Validation?

Upgrade io.undertow:undertow-core to version 2.2.32.Final, 2.3.13.Final or higher.

[,2.2.32.Final) [2.3.0.Alpha1,2.3.13.Final)
Go back to all versions of this package