CVE-2021-3690

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.3"
                },
                {
                    "last_affected": "7.3"
                },
                {
                    "introduced": "7.4"
                },
                {
                    "last_affected": "7.4"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "redhat:jboss_enterprise_application_platform"
        }
    ]
}

References

Affected packages

Git / github.com/libfuse/libfuse

Affected ranges

Type

GIT

Repo

https://github.com/libfuse/libfuse

Events

Introduced

ce63733284dd6519d2f4ca03c6aa8a6caa328379

Last Affected

ce63733284dd6519d2f4ca03c6aa8a6caa328379

Database specific

Show details

{
    "cpe": "cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.0

Other

debian_version_1_0-1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3690.json"

Git / github.com/undertow-io/undertow

Affected ranges

Type

GIT

Repo

https://github.com/undertow-io/undertow

Events

Introduced

Fixed

225d62735b189e460a56460207b8c6073fcc3737

Introduced

2291c7c07dc5bccf3b45c4db3a1b63123b8ce484

Fixed

40926588d550bf28f583617d93a0a1520110a2d0

Fixed

c7e84a0b7efced38506d7d1dfea5902366973877

Database specific

Show details

{
    "cpe": "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.40"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.2.10"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0.Alpha1

1.0.0.Alpha10

1.0.0.Alpha11

1.0.0.Alpha12

1.0.0.Alpha13

1.0.0.Alpha14

1.0.0.Alpha15

1.0.0.Alpha16

1.0.0.Alpha17

1.0.0.Alpha18

1.0.0.Alpha19

1.0.0.Alpha2

1.0.0.Alpha20

1.0.0.Alpha21

1.0.0.Alpha22

1.0.0.Alpha3

1.0.0.Alpha4

1.0.0.Alpha5

1.0.0.Alpha6

1.0.0.Alpha7

1.0.0.Alpha8

1.0.0.Alpha9

1.0.0.Beta1

1.0.0.Beta10

1.0.0.Beta11

1.0.0.Beta12

1.0.0.Beta13

1.0.0.Beta14

1.0.0.Beta15

1.0.0.Beta16

1.0.0.Beta17

1.0.0.Beta18

1.0.0.Beta19

1.0.0.Beta2

1.0.0.Beta20

1.0.0.Beta21

1.0.0.Beta22

1.0.0.Beta23

1.0.0.Beta24

1.0.0.Beta25

1.0.0.Beta26

1.0.0.Beta27

1.0.0.Beta28

1.0.0.Beta29

1.0.0.Beta3

1.0.0.Beta30

1.0.0.Beta31

1.0.0.Beta32

1.0.0.Beta33

1.0.0.Beta4

1.0.0.Beta5

1.0.0.Beta6

1.0.0.Beta7

1.0.0.Beta8

1.0.0.Beta9

1.0.0.CR1

1.0.0.CR2

1.0.0.CR3

1.0.0.CR4

1.0.0.Final

1.0.1.Final

1.0.2.Final

1.0.3.Final

1.1.0.Beta1

1.1.0.Beta2

1.1.0.Beta3

1.1.0.Beta4

1.1.0.Beta5

1.1.0.Beta6

1.1.0.Beta7

1.1.0.Beta8

1.2.0.Beta1

1.2.0.Beta10

1.2.0.Beta2

1.2.0.Beta3

1.2.0.Beta4

1.2.0.Beta5

1.2.0.Beta6

1.2.0.Beta7

1.2.0.Beta8

1.2.0.Beta9

1.2.0.CR1

1.2.0.Final

1.2.1.Final

1.2.2.Final

1.2.3.Final

1.2.4.Final

1.3.0.Beta1

1.3.0.Beta10

1.3.0.Beta11

1.3.0.Beta12

1.3.0.Beta13

1.3.0.Beta2

1.3.0.Beta3

1.3.0.Beta4

1.3.0.Beta5

1.3.0.Beta6

1.3.0.Beta7

1.3.0.Beta8

1.3.0.Beta9

1.3.0.CR1

1.3.0.CR2

1.3.0.CR3

1.3.0.Final

1.3.1.Final

1.3.2.Final

1.3.3.Final

2.*

2.0.0.Alpha1

2.0.0.Beta1

2.0.0.Final

2.0.1.Final

2.0.10.Final

2.0.11.Final

2.0.12.Final

2.0.13.Final

2.0.14.Final

2.0.15.Final

2.0.16.Final

2.0.17.Final

2.0.2.Final

2.0.20.Final

2.0.21.Final

2.0.22.Final

2.0.23.Final

2.0.24.Final

2.0.25.Final

2.0.26.Final

2.0.27.Final

2.0.28.Final

2.0.29.Final

2.0.3.Final

2.0.30.Final

2.0.31.Final

2.0.32.Final

2.0.33.Final

2.0.34.Final

2.0.35.Final

2.0.36.Final

2.0.37.Final

2.0.38.Final

2.0.39.Final

2.0.4.Final

2.0.5.Final

2.0.6.Final

2.0.7.Final

2.0.8.Final

2.0.9.Final

2.1.0.Final

2.1.1.Final

2.1.2.Final

2.1.3.Final

2.1.4.Final

2.2.0.Final

2.2.1.Final

2.2.2.Final

2.2.3.Final

2.2.4.Final

2.2.5.Final

2.2.6.Final

2.2.7.Final

2.2.8.Final

2.2.9.Final

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3690.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "187851407789216287730490246308857511865",
            "length": 601
        },
        "id": "CVE-2021-3690-45402648",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877",
        "target": {
            "file": "websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java",
            "function": "onFullPongMessage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "79403700335528539273770068144736272793",
                "79857656579781679713873665099933085318",
                "244125084856819352952595829882912148068",
                "137441744319017044843376062865140644092"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-3690-e32340ef",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877",
        "target": {
            "file": "websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java"
        }
    }
]

vanir_signatures_modified

"2026-09-30T00:42:33Z"