VYPR
← All advisories
High severityNVD Advisory· Published Aug 23, 2022· Updated Aug 3, 2024

CVE-2021-3690

CVE-2021-3690

Description

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Undertow WebSocket PONG message memory leak allows denial of service via memory exhaustion.

CVE-2021-3690 is a vulnerability in the Undertow web server. The flaw is a buffer leak that occurs when the server processes an incoming WebSocket PONG message. The root cause is improper release of allocated buffers, which leads to memory exhaustion over time [1][3].

The attack surface is the WebSocket endpoint. An attacker can trigger repeated PONG messages without prior authentication, as the vulnerability can be exploited pre-authentication in many configurations. The attack can be carried out over the network from an unprivileged position, requiring no special access or credentials [1][2][3].

Successful exploitation results in a denial of service (DoS) due to memory exhaustion, making the server unavailable for legitimate requests. The CVSS 3.1 base score of 7.5 (High) reflects the relatively low complexity and network-based attack vector, with the primary impact on availability [1][2][3].

Red Hat and other vendors have released patches for this flaw. Users should update Undertow to the fixed version containing the commit that addresses the buffer leak (commit reference [4]). No known public exploit code has been published [3][4].

References
  1. cve-details
  2. cve-details
  3. NVD - CVE-2021-3690
  4. [UNDERTOW-1935] - buffer leak on incoming websocket PONG message · undertow-io/undertow@c7e84a0

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.undertow:undertow-coreMaven
< 2.0.402.0.40
io.undertow:undertow-coreMaven
>= 2.2.0, < 2.2.102.2.10

Affected products

2

Patches

1
c7e84a0b7efc

[UNDERTOW-1935] - buffer leak on incoming websocket PONG message

https://github.com/undertow-io/undertowAndrey MarinchukJul 30, 2021via ghsa
commit
1 file changed · +2 −0
  • websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java+2 −0 modified
    @@ -152,6 +152,8 @@ public void run() {
                     }
                 }
             });
+        } else {
+            bufferedBinaryMessage.getData().free();
         }
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.