CVE-2021-3859

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Database specific

{
    "unresolved_ranges": [
        {
            "cpe": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.3"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.4"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:a:redhat:single_sign-on:7.4.10:*:*:*:*:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.4.10"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:a:redhat:single_sign-on:7.5.1:*:*:*:*:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.5.1"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/undertow-io/undertow

Affected ranges

Type

GIT

Repo

https://github.com/undertow-io/undertow

Events

Introduced

Fixed

c0b0d337dbb56bbc5f5190dd9ba6579a8afbd17d

Fixed

e43f0ada3f4da6e8579e0020cec3cb1a81e487c2

Database specific

{
    "cpe": "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.15"
        }
    ]
}

Affected versions

1.*

1.0.0.Alpha1

1.0.0.Alpha10

1.0.0.Alpha11

1.0.0.Alpha12

1.0.0.Alpha13

1.0.0.Alpha14

1.0.0.Alpha15

1.0.0.Alpha16

1.0.0.Alpha17

1.0.0.Alpha18

1.0.0.Alpha19

1.0.0.Alpha2

1.0.0.Alpha20

1.0.0.Alpha21

1.0.0.Alpha22

1.0.0.Alpha3

1.0.0.Alpha4

1.0.0.Alpha5

1.0.0.Alpha6

1.0.0.Alpha7

1.0.0.Alpha8

1.0.0.Alpha9

1.0.0.Beta1

1.0.0.Beta10

1.0.0.Beta11

1.0.0.Beta12

1.0.0.Beta13

1.0.0.Beta14

1.0.0.Beta15

1.0.0.Beta16

1.0.0.Beta17

1.0.0.Beta18

1.0.0.Beta19

1.0.0.Beta2

1.0.0.Beta20

1.0.0.Beta21

1.0.0.Beta22

1.0.0.Beta23

1.0.0.Beta24

1.0.0.Beta25

1.0.0.Beta26

1.0.0.Beta27

1.0.0.Beta28

1.0.0.Beta29

1.0.0.Beta3

1.0.0.Beta30

1.0.0.Beta31

1.0.0.Beta32

1.0.0.Beta33

1.0.0.Beta4

1.0.0.Beta5

1.0.0.Beta6

1.0.0.Beta7

1.0.0.Beta8

1.0.0.Beta9

1.0.0.CR1

1.0.0.CR2

1.0.0.CR3

1.0.0.CR4

1.0.0.Final

1.0.1.Final

1.0.2.Final

1.0.3.Final

1.1.0.Beta1

1.1.0.Beta2

1.1.0.Beta3

1.1.0.Beta4

1.1.0.Beta5

1.1.0.Beta6

1.1.0.Beta7

1.1.0.Beta8

1.2.0.Beta1

1.2.0.Beta10

1.2.0.Beta2

1.2.0.Beta3

1.2.0.Beta4

1.2.0.Beta5

1.2.0.Beta6

1.2.0.Beta7

1.2.0.Beta8

1.2.0.Beta9

1.2.0.CR1

1.2.0.Final

1.2.1.Final

1.2.2.Final

1.2.3.Final

1.2.4.Final

1.3.0.Beta1

1.3.0.Beta10

1.3.0.Beta11

1.3.0.Beta12

1.3.0.Beta13

1.3.0.Beta2

1.3.0.Beta3

1.3.0.Beta4

1.3.0.Beta5

1.3.0.Beta6

1.3.0.Beta7

1.3.0.Beta8

1.3.0.Beta9

1.3.0.CR1

1.3.0.CR2

1.3.0.CR3

1.3.0.Final

1.3.1.Final

1.3.2.Final

1.3.3.Final

2.*

2.0.0.Alpha1

2.0.0.Beta1

2.0.0.Final

2.0.1.Final

2.0.10.Final

2.0.11.Final

2.0.12.Final

2.0.13.Final

2.0.14.Final

2.0.15.Final

2.0.16.Final

2.0.17.Final

2.0.2.Final

2.0.20.Final

2.0.21.Final

2.0.22.Final

2.0.23.Final

2.0.24.Final

2.0.25.Final

2.0.26.Final

2.0.27.Final

2.0.28.Final

2.0.29.Final

2.0.3.Final

2.0.4.Final

2.0.5.Final

2.0.6.Final

2.0.7.Final

2.0.8.Final

2.0.9.Final

2.1.0.Final

2.1.1.Final

2.1.2.Final

2.1.3.Final

2.1.4.Final

2.2.0.Final

2.2.1.Final

2.2.10.Final

2.2.11.Final

2.2.12.Final

2.2.13.Final

2.2.14.Final

2.2.2.Final

2.2.3.Final

2.2.4.Final

2.2.5.Final

2.2.6.Final

2.2.7.Final

2.2.8.Final

2.2.9.Final

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3859.json"

vanir_signatures_modified

"2026-04-12T01:57:51Z"

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "37843366493750751742619379260952401598",
                "7440480657494467487553469539626601166",
                "276016304061374303955031587394107556688",
                "33025093169843178057269548979765714246",
                "73007699941547598036833828651447045206",
                "281097977987362871672003164118742789719",
                "219130153540905508636829466680708263762",
                "15958409315759019669908654030384320735"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "core/src/main/java/io/undertow/protocols/http2/HpackEncoder.java"
        },
        "source": "https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2",
        "signature_version": "v1",
        "id": "CVE-2021-3859-137c9e03"
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "278718351439749032103358072259880297915",
                "217996040743920694930878954795178553663",
                "194636829920015321065860618077163562720",
                "272077580847901113784842885408509213057",
                "335496155086488876403469198514903259863",
                "93657172332355147865052391949714358868",
                "10177502587792283635465765649640402178",
                "6822285975597295230959649532656960108",
                "2961991051668216914488364019458986316",
                "271247688705289436524263595311819397500"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "core/src/main/java/io/undertow/protocols/http2/Http2Channel.java"
        },
        "source": "https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2",
        "signature_version": "v1",
        "id": "CVE-2021-3859-80ae0061"
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "197540148066880075987836166995993802539",
            "length": 2626.0
        },
        "target": {
            "file": "core/src/main/java/io/undertow/protocols/http2/HpackEncoder.java",
            "function": "encode"
        },
        "source": "https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2",
        "signature_version": "v1",
        "id": "CVE-2021-3859-a100b2a7"
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "291203542927830118324038302489004741089",
            "length": 1089.0
        },
        "target": {
            "file": "core/src/main/java/io/undertow/protocols/http2/Http2Channel.java",
            "function": "parseFrame"
        },
        "source": "https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2",
        "signature_version": "v1",
        "id": "CVE-2021-3859-b0ceb238"
    }
]