Denial Of Service (DoS)

2024-07-1008:12:30

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

undertow

vulnerability

chunked responses

denial of service

java 17

tlsv1.3

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

Low

EPSS

Percentile

13.7%

JSON

Undertow is vulnerable to Denial Of Service (DoS). The vulnerability is due to Undertow’s failure to send the expected termination sequence (0\r\n) for chunked responses after flushing the response body. The vulnerability allows an attacker to exploit the incomplete handling of chunked responses in Undertow, potentially causing uncontrolled resource consumption. Note this vulnerability is only exploitable when running on Java 17 with TLSv1.3.