{"id":"CVE-2021-3859","aliases":["DEBIAN-CVE-2021-3859","EUVD-2022-6212","GHSA-339q-62wm-c39w","RHSA-2022:0400","RHSA-2022:0401","RHSA-2022:0405","RHSA-2022:0447","RHSA-2022:0448","RHSA-2024:10207","RHSA-2025:4226","UBUNTU-CVE-2021-3859"],"status":"published","title":"Undertow vulnerable to Denial of Service (DoS) attacks","description":"A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01837,"percentile":0.79257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-214","CWE-400","CWE-668"],"published":"2022-07-15T21:32:13Z","modified":"2026-10-23T18:03:50Z","fixes":[{"ecosystem":"Maven","package":"io.undertow:undertow-core","fixed_in":["2.2.15"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"undertow","fixed_in":["2.2.16-1"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:7.3::el6","package":"eap7-undertow","fixed_in":["0:2.0.41-2.SP2_redhat_00001.1.el6eap"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:7.3::el7","package":"eap7-undertow","fixed_in":["0:2.0.41-2.SP2_redhat_00001.1.el7eap"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:7.3::el8","package":"eap7-undertow","fixed_in":["0:2.0.41-2.SP2_redhat_00001.1.el8eap"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.undertow:undertow-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.15"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}],"versions":["1.3.11-1","1.3.16-1","1.3.19-1","1.3.21-1","1.3.23-1","1.3.4-1","1.3.5-1","1.3.7-1","1.4.0-1","1.4.1-1","1.4.18-1","1.4.20-1","1.4.21-1","1.4.21-2","1.4.22-1","1.4.23-1","1.4.23-2","1.4.23-3","1.4.25-1","1.4.25-2","1.4.3-1","1.4.4-1","1.4.6-1","1.4.7-1","1.4.8-1","2.0.23-1","2.0.25-1","2.0.26-1","2.0.27-1","2.0.28-1","2.0.29-1","2.0.30-1","2.1.0-1","2.1.1-1","2.1.3-1","2.2.0-1","2.2.10-1","2.2.12-1","2.2.13-1","2.2.14-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.8-1"]},{"source":"osv","ecosystem":"Maven","package":"io.undertow:undertow-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.15"}]}],"versions":["1.0.0.Alpha1","1.0.0.Alpha10","1.0.0.Alpha11","1.0.0.Alpha12","1.0.0.Alpha13","1.0.0.Alpha14","1.0.0.Alpha15","1.0.0.Alpha16","1.0.0.Alpha17","1.0.0.Alpha18","1.0.0.Alpha19","1.0.0.Alpha2","1.0.0.Alpha20","1.0.0.Alpha21","1.0.0.Alpha22","1.0.0.Alpha3","1.0.0.Alpha4","1.0.0.Alpha5","1.0.0.Alpha6","1.0.0.Alpha7","1.0.0.Alpha8","1.0.0.Alpha9","1.0.0.Beta1","1.0.0.Beta10","1.0.0.Beta11","1.0.0.Beta12","1.0.0.Beta13","1.0.0.Beta14","1.0.0.Beta15","1.0.0.Beta16","1.0.0.Beta17","1.0.0.Beta18","1.0.0.Beta19","1.0.0.Beta2","1.0.0.Beta20","1.0.0.Beta21","1.0.0.Beta22","1.0.0.Beta23","1.0.0.Beta24","1.0.0.Beta25","1.0.0.Beta26","1.0.0.Beta27","1.0.0.Beta28","1.0.0.Beta29","1.0.0.Beta3","1.0.0.Beta30","1.0.0.Beta31","1.0.0.Beta32","1.0.0.Beta33","1.0.0.Beta4","1.0.0.Beta5","1.0.0.Beta6","1.0.0.Beta7","1.0.0.Beta8","1.0.0.Beta9","1.0.0.CR1","1.0.0.CR2","1.0.0.CR3","1.0.0.CR4","1.0.0.CR5","1.0.0.Final","1.0.1.Final","1.0.10.Final","1.0.11.Final","1.0.12.Final","1.0.13.Final","1.0.14.Final","1.0.15.Final","1.0.16.Final","1.0.17.Final","1.0.18.Final","1.0.19.Final","1.0.2.Final","1.0.3.Final","1.0.4.Final","1.0.5.Final","1.0.6.Final","1.0.7.Final","1.0.8.Final","1.0.9.Final","1.1.0.Beta1","1.1.0.Beta2","1.1.0.Beta3","1.1.0.Beta4","1.1.0.Beta5","1.1.0.Beta6","1.1.0.Beta7","1.1.0.Beta8","1.1.0.CR1","1.1.0.CR2","1.1.0.CR3","1.1.0.CR4","1.1.0.CR5","1.1.0.CR6","1.1.0.CR7","1.1.0.CR8","1.1.0.Final","1.1.1.Final","1.1.2.Final","1.1.3.Final","1.1.4.Final","1.1.5.Final","1.1.6.Final","1.1.7.Final","1.1.8.Final","1.1.9.Final","1.2.0.Beta1","1.2.0.Beta10","1.2.0.Beta2","1.2.0.Beta3","1.2.0.Beta4","1.2.0.Beta5","1.2.0.Beta6","1.2.0.Beta7","1.2.0.Beta8","1.2.0.Beta9","1.2.0.CR1","1.2.0.Final","1.2.1.Final","1.2.10.Final","1.2.11.Final","1.2.12.Final","1.2.2.Final","1.2.3.Final","1.2.4.Final","1.2.5.Final","1.2.6.Final","1.2.7.Final","1.2.8.Final","1.2.9.Final","1.3.0.Beta1","1.3.0.Beta10","1.3.0.Beta11","1.3.0.Beta12","1.3.0.Beta13","1.3.0.Beta2","1.3.0.Beta3","1.3.0.Beta4","1.3.0.Beta5","1.3.0.Beta6","1.3.0.Beta7","1.3.0.Beta8","1.3.0.Beta9","1.3.0.CR1","1.3.0.CR2","1.3.0.CR3","1.3.0.Final","1.3.1.Final","1.3.10.Final","1.3.11.Final","1.3.12.Final","1.3.13.Final","1.3.14.Final","1.3.15.Final","1.3.16.Final","1.3.17.Final","1.3.18.Final","1.3.19.Final","1.3.2.Final","1.3.20.Final","1.3.21.Final","1.3.22.Final","1.3.23.Final","1.3.24.Final","1.3.25.Final","1.3.26.Final","1.3.27.Final","1.3.28.Final","1.3.29.Final","1.3.3.Final","1.3.30.Final","1.3.31.Final","1.3.32.Final","1.3.33.Final","1.3.4.Final","1.3.5.Final","1.3.6.Final","1.3.7.Final","1.3.8.Final","1.3.9.Final","1.4.0.Beta1","1.4.0.CR1","1.4.0.CR2","1.4.0.CR3","1.4.0.CR4","1.4.0.Final","1.4.1.Final","1.4.10.Final","1.4.11.Final","1.4.12.Final","1.4.13.Final","1.4.14.Final","1.4.15.Final","1.4.16.Final","1.4.17.Final","1.4.18.Final","1.4.19.Final","1.4.2.Final","1.4.20.Final","1.4.21.Final","1.4.22.Final","1.4.23.Final","1.4.24.Final","1.4.25.Final","1.4.26.Final","1.4.27.Final","1.4.28.Final","1.4.3.Final","1.4.4.Final","1.4.5.Final","1.4.6.Final","1.4.7.Final","1.4.8.Final","1.4.9.Final","2.0.0.Alpha1","2.0.0.Beta1","2.0.0.Final","2.0.1.Final","2.0.10.Final","2.0.11.Final","2.0.12.Final","2.0.13.Final","2.0.14.Final","2.0.15.Final","2.0.16.Final","2.0.17.Final","2.0.18.Final","2.0.19.Final","2.0.2.Final","2.0.20.Final","2.0.21.Final","2.0.22.Final","2.0.23.Final","2.0.24.Final","2.0.25.Final","2.0.26.Final","2.0.27.Final","2.0.28.Final","2.0.29.Final","2.0.3.Final","2.0.30.Final","2.0.31.Final","2.0.32.Final","2.0.33.Final","2.0.34.Final","2.0.35.Final","2.0.36.Final","2.0.37.Final","2.0.38.Final","2.0.39.Final","2.0.4.Final","2.0.40.Final","2.0.41.Final","2.0.42.Final","2.0.5.Final","2.0.6.Final","2.0.7.Final","2.0.8.Final","2.0.9.Final","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.1.5.Final","2.1.6.Final","2.1.7.Final","2.1.8.Final","2.2.0.Final","2.2.1.Final","2.2.10.Final","2.2.11.Final","2.2.12.Final","2.2.13.Final","2.2.14.Final","2.2.2.Final","2.2.3.Final","2.2.4.Final","2.2.5.Final","2.2.6.Final","2.2.7.Final","2.2.8.Final","2.2.9.Final"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-1.SP2_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hornetq-jms-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el7eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.13-1.SP2_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hornetq-jms-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.Final_redhat_00001.1.el8eap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.3::el6","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.41-2.SP2_redhat_00001.1.el6eap"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.3::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.41-2.SP2_redhat_00001.1.el7eap"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.3::el8","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.41-2.SP2_redhat_00001.1.el8eap"}]}]},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el7","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.4-1.redhat_00003.1.el7sso"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el7","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.4-1.redhat_00003.1.el7sso"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el8","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.4-1.redhat_00003.1.el8sso"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.5::el8","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.4-1.redhat_00003.1.el8sso"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-1.SP1_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.6-8.redhat_00003.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-h2database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.197-3.redhat_00004.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-annotations-api_1.3_spec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-4.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-marshalling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-marshalling-river","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap6.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap6.4-to-eap7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.2-to-eap7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.3-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly10.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly11.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly12.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly13.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly14.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly15.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly16.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly17.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly18.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly8.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-12.Final_redhat_00013.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.13-1.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-log4j-jboss-logmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.Final_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.11-4.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.11-4.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.11-4.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.11-4.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.11-4.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wss4j-bindings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wss4j-policy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wss4j-ws-security-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wss4j-ws-security-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wss4j-ws-security-policy-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wss4j-ws-security-stax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-38.redhat_00015.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.3-2.redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-jms-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-jms-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-activemq-artemis-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-artemis-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-artemis-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-artemis-native-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.5.016-1.redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jboss-xnio-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.11-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.2-1.redhat_00002.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.18-14.SP13_redhat_00001.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.10-2.GA_redhat_00002.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.10-2.GA_redhat_00002.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-woodstox-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.3-2.redhat_00002.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-xml-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-2.redhat_00002.1.ep7.el7"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-1","1.3.5-1","1.3.7-1","1.3.11-1","1.3.16-1","1.3.16-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.22-1","1.4.23-1","1.4.23-2build1","1.4.23-3","1.4.23-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.23-1","2.0.27-1","2.0.28-1","2.0.29-1","2.0.29-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-1","2.2.12-1","2.2.13-1","2.2.14-1","2.2.16-1","2.2.16-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-2","2.3.8-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.18-1","2.3.18-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.20-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.18-2","2.3.20-1","2.3.20-1ubuntu1"]}],"products":[{"vendor":"netapp","product":"cloud_secure_agent"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"red hat","product":"undertow"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"single_sign-on"},{"vendor":"redhat","product":"undertow"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010378","tags":["x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://issues.redhat.com/browse/UNDERTOW-1979","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/undertow-io/undertow/pull/1296","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3859","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20221201-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3859","tags":["advisory"]},{"url":"https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8","tags":["web"]},{"url":"https://access.redhat.com/security/cve/cve-2021-3859","tags":["web"]},{"url":"https://github.com/advisories/GHSA-339q-62wm-c39w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3859","tags":["advisory"]},{"url":"https://github.com/undertow-io/undertow","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20221201-0004","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0400","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010559","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-22100","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22104","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22106","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22108","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22373","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22505","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22575","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22582","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22586","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22587","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22590","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22609","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22641","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22668","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22679","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22692","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22693","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22740","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22754","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22793","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22822","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22823","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22833","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-22851","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0400.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3859","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20318","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0401","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-22642","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0401.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0405","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0405.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0447","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041967","tags":["report"]},{"url":"https://issues.redhat.com/browse/CIAM-1976","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0447.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4104","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2021-009","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4104","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126","tags":["article"]},{"url":"https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301","tags":["article"]},{"url":"https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2021/12/13/1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23302","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23302","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2022/01/18/3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23305","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2022/01/18/4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23307","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2022/01/18/5","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0448","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0448.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10207","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2316116","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-23025","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10207.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23221","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-45hx-wfhj-473x","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41853","tags":["advisory"]},{"url":"http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control","tags":["article"]},{"url":"https://github.com/advisories/GHSA-77xx-rxvh-q682","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46364","tags":["advisory"]},{"url":"https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3171","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3171","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5685","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5685","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-26464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26464","tags":["advisory"]},{"url":"https://www.ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39410","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39410","tags":["advisory"]},{"url":"https://issues.apache.org/jira/browse/AVRO-3819","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28752","tags":["advisory"]},{"url":"https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt","tags":["article"]},{"url":"https://github.com/advisories/GHSA-qmgx-j96g-4428","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47561","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47561","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47561","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4226","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264928","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-29286","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4226.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37714","tags":["advisory"]},{"url":"https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-40690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40690","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0084","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1319","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1319","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2053","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23913","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fjynj57rd99s814rdn5hzvmx8lz403q2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25647","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25647","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25857","tags":["advisory"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/525","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40149","tags":["advisory"]},{"url":"https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40152","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3f7h-mf4q-vrm4","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1108","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m4mm-pg93-fv78","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1973","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1973","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3223","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1635","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3859","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3859","description":"A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.","status":"published","published":"2022-08-26T00:00:00Z","modified":"2024-08-03T17:09:09.581Z","cwes":["CWE-214"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2022-6212","description":"A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.","status":"published","published":"2022-08-26T00:00:00Z","modified":"2024-08-03T17:09:09Z","updated_at":"2026-11-03T03:25:10.888157Z"}],"ghsa":[{"id":"GHSA-339q-62wm-c39w","title":"Undertow vulnerable to Denial of Service (DoS) attacks","description":"Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.","status":"published","published":"2022-07-15T21:32:13Z","modified":"2023-01-28T05:02:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-214","CWE-400","CWE-668"],"updated_at":"2026-11-02T14:36:23.433782Z"}],"nvd":[{"id":"CVE-2021-3859","description":"A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.","status":"published","published":"2022-08-26T16:15:09.623Z","modified":"2026-06-17T04:05:54.58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-214","CWE-668"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-3859","description":"A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.","status":"published","published":"2022-08-26T16:15:09.623Z","modified":"2026-10-20T14:26:16.505124982Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-3859","description":"A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.","status":"published","published":"2022-08-26T16:15:09.623Z","modified":"2026-10-23T18:03:50.12603265Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-339q-62wm-c39w","title":"Undertow vulnerable to Denial of Service (DoS) attacks","description":"Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.","status":"published","published":"2022-07-15T21:32:13Z","modified":"2024-02-22T05:34:10.798768Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-214","CWE-400","CWE-668"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"RHSA-2022:0400","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update","status":"published","published":"2024-09-16T06:46:00Z","modified":"2026-10-02T10:01:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0401","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update","status":"published","published":"2024-09-16T06:45:52Z","modified":"2026-10-02T10:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0405","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update","status":"published","published":"2024-09-13T17:33:33Z","modified":"2026-10-02T10:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0447","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7","status":"published","published":"2024-09-29T18:50:58Z","modified":"2026-10-13T10:02:54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0448","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8","status":"published","published":"2024-09-29T18:50:50Z","modified":"2026-10-13T10:02:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2024:10207","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update","status":"published","published":"2024-11-26T07:31:41Z","modified":"2026-10-20T10:02:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2025:4226","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update","status":"published","published":"2025-04-28T10:03:38Z","modified":"2026-10-14T10:10:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"UBUNTU-CVE-2021-3859","description":"A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.","status":"published","published":"2022-08-26T16:15:00Z","modified":"2026-10-17T12:57:14.404683024Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"}]}}