CVE-2021-3690

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0"
                },
                {
                    "last_affected": "1.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "redhat:fuse",
            "cpes": [
                "cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "7.3"
                },
                {
                    "last_affected": "7.3"
                },
                {
                    "introduced": "7.4"
                },
                {
                    "last_affected": "7.4"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "redhat:jboss_enterprise_application_platform",
            "cpes": [
                "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

Affected packages

Git / github.com/undertow-io/undertow

Affected ranges

Type

GIT

Repo

https://github.com/undertow-io/undertow

Events

Introduced

Fixed

225d62735b189e460a56460207b8c6073fcc3737

Introduced

2291c7c07dc5bccf3b45c4db3a1b63123b8ce484

Fixed

40926588d550bf28f583617d93a0a1520110a2d0

Fixed

c7e84a0b7efced38506d7d1dfea5902366973877

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.40"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.2.10"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*"
}

Affected versions

1.*

1.0.0.Alpha1

1.0.0.Alpha10

1.0.0.Alpha11

1.0.0.Alpha12

1.0.0.Alpha13

1.0.0.Alpha14

1.0.0.Alpha15

1.0.0.Alpha16

1.0.0.Alpha17

1.0.0.Alpha18

1.0.0.Alpha19

1.0.0.Alpha2

1.0.0.Alpha20

1.0.0.Alpha21

1.0.0.Alpha22

1.0.0.Alpha3

1.0.0.Alpha4

1.0.0.Alpha5

1.0.0.Alpha6

1.0.0.Alpha7

1.0.0.Alpha8

1.0.0.Alpha9

1.0.0.Beta1

1.0.0.Beta10

1.0.0.Beta11

1.0.0.Beta12

1.0.0.Beta13

1.0.0.Beta14

1.0.0.Beta15

1.0.0.Beta16

1.0.0.Beta17

1.0.0.Beta18

1.0.0.Beta19

1.0.0.Beta2

1.0.0.Beta20

1.0.0.Beta21

1.0.0.Beta22

1.0.0.Beta23

1.0.0.Beta24

1.0.0.Beta25

1.0.0.Beta26

1.0.0.Beta27

1.0.0.Beta28

1.0.0.Beta29

1.0.0.Beta3

1.0.0.Beta30

1.0.0.Beta31

1.0.0.Beta32

1.0.0.Beta33

1.0.0.Beta4

1.0.0.Beta5

1.0.0.Beta6

1.0.0.Beta7

1.0.0.Beta8

1.0.0.Beta9

1.0.0.CR1

1.0.0.CR2

1.0.0.CR3

1.0.0.CR4

1.0.0.Final

1.0.1.Final

1.0.2.Final

1.0.3.Final

1.1.0.Beta1

1.1.0.Beta2

1.1.0.Beta3

1.1.0.Beta4

1.1.0.Beta5

1.1.0.Beta6

1.1.0.Beta7

1.1.0.Beta8

1.2.0.Beta1

1.2.0.Beta10

1.2.0.Beta2

1.2.0.Beta3

1.2.0.Beta4

1.2.0.Beta5

1.2.0.Beta6

1.2.0.Beta7

1.2.0.Beta8

1.2.0.Beta9

1.2.0.CR1

1.2.0.Final

1.2.1.Final

1.2.2.Final

1.2.3.Final

1.2.4.Final

1.3.0.Beta1

1.3.0.Beta10

1.3.0.Beta11

1.3.0.Beta12

1.3.0.Beta13

1.3.0.Beta2

1.3.0.Beta3

1.3.0.Beta4

1.3.0.Beta5

1.3.0.Beta6

1.3.0.Beta7

1.3.0.Beta8

1.3.0.Beta9

1.3.0.CR1

1.3.0.CR2

1.3.0.CR3

1.3.0.Final

1.3.1.Final

1.3.2.Final

1.3.3.Final

2.*

2.0.0.Alpha1

2.0.0.Beta1

2.0.0.Final

2.0.1.Final

2.0.10.Final

2.0.11.Final

2.0.12.Final

2.0.13.Final

2.0.14.Final

2.0.15.Final

2.0.16.Final

2.0.17.Final

2.0.2.Final

2.0.20.Final

2.0.21.Final

2.0.22.Final

2.0.23.Final

2.0.24.Final

2.0.25.Final

2.0.26.Final

2.0.27.Final

2.0.28.Final

2.0.29.Final

2.0.3.Final

2.0.30.Final

2.0.31.Final

2.0.32.Final

2.0.33.Final

2.0.34.Final

2.0.35.Final

2.0.36.Final

2.0.37.Final

2.0.38.Final

2.0.39.Final

2.0.4.Final

2.0.5.Final

2.0.6.Final

2.0.7.Final

2.0.8.Final

2.0.9.Final

2.1.0.Final

2.1.1.Final

2.1.2.Final

2.1.3.Final

2.1.4.Final

2.2.0.Final

2.2.1.Final

2.2.2.Final

2.2.3.Final

2.2.4.Final

2.2.5.Final

2.2.6.Final

2.2.7.Final

2.2.8.Final

2.2.9.Final

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3690.json"

vanir_signatures_modified

"2026-07-09T01:31:23Z"

vanir_signatures

[
    {
        "digest": {
            "function_hash": "187851407789216287730490246308857511865",
            "length": 601.0
        },
        "id": "CVE-2021-3690-45402648",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877",
        "signature_type": "Function",
        "target": {
            "function": "onFullPongMessage",
            "file": "websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "79403700335528539273770068144736272793",
                "79857656579781679713873665099933085318",
                "244125084856819352952595829882912148068",
                "137441744319017044843376062865140644092"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-3690-e32340ef",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877",
        "signature_type": "Line",
        "target": {
            "file": "websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java"
        }
    }
]