What’s Vulnerable › Vulnerabilities

CVE-2021-3859

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-26 · updated 2026-06-17
• Weakness: CWE-214

Description

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Affected products

• NetApp Cloud Secure Agent: all versions
• OnCommand Insight: all versions
• NetApp OnCommand Workflow Automation: all versions
• Red Hat JBoss EAP: 7.3, 7.4
• Red Hat Single Sign-On: 7.4.10, 7.5.1
• Red Hat undertow: before 2.2.15 — fixed in 2.2.15

How to fix

Upgrade to a fixed version: Red Hat undertow 2.2.15. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2021-3859
• https://bugzilla.redhat.com/show_bug.cgi?id=2010378
• https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
• https://github.com/undertow-io/undertow/pull/1296
• https://issues.redhat.com/browse/UNDERTOW-1979
• https://security.netapp.com/advisory/ntap-20221201-0004/
• https://access.redhat.com/security/cve/CVE-2021-3859
• https://bugzilla.redhat.com/show_bug.cgi?id=2010378
• https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
• https://github.com/undertow-io/undertow/pull/1296
• https://issues.redhat.com/browse/UNDERTOW-1979
• https://security.netapp.com/advisory/ntap-20221201-0004/

Get alerted when CVE-2021-3859 or the next vulnerability affects your stack