CVE-2021-3859

25

FAUCET Score

CVE-2021-3859 describes a denial-of-service vulnerability in Undertow, affecting products from NetApp and Red Hat. This flaw allows an unauthenticated attacker to trigger client-side invocation timeouts via specially crafted HTTP/2 calls, leading to service disruption. With a CVSS score of 7.5 (High), it presents a significant risk due to its low attack complexity and network-based vector. While no public exploits or active exploitation have been observed, and community discussion is minimal, organizations should still address this vulnerability to mitigate potential DoS attacks.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		7.3CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:::::::*
		7.4CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:::::::*
		7.4.10CPE matchmatch criteria	cpe:2.3:a:redhat:single_sign-on:7.4.10:::::::*
		7.5.1CPE matchmatch criteria	cpe:2.3:a:redhat:single_sign-on:7.5.1:::::::*
		< 2.2.15CPE matchmatch criteria	cpe:2.3:a:redhat:undertow::::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.30%

Probability of exploitation in next 30 days

EPSS Percentile

67.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0130 is in the 47th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (40)

github_advisorypatch availablevia nvd_reference

mavenpatch availablevia ghsa

Product: io.undertow:undertow-coreFixed in: 2.2.15

redhatpatch availablevia redhat_api

Product: Red Hat Fuse 7.11Fixed in: undertow

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application PlatformFixed in: io.undertow/undertow-core:2.2.13.SP2-redhat-00001

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-activemq-artemis-0:1.5.5.016-1.redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-artemis-native-1:1.5.5.016-1.redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.5.11-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jsoup-0:1.14.2-1.redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-undertow-0:1.4.18-14.SP13_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.1.10-2.GA_redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-woodstox-core-0:5.0.3-2.redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-xml-security-0:2.0.10-2.redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6Fixed in: eap7-undertow-0:2.0.41-2.SP2_redhat_00001.1.el6eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7Fixed in: eap7-undertow-0:2.0.41-2.SP2_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8Fixed in: eap7-undertow-0:2.0.41-2.SP2_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-undertow-0:2.2.13-1.SP2_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-undertow-0:2.2.13-1.SP2_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7.4.10Fixed in: undertow

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7.5 for RHEL 7Fixed in: rh-sso7-keycloak-0:15.0.4-1.redhat_00003.1.el7sso

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7.5 for RHEL 8Fixed in: rh-sso7-keycloak-0:15.0.4-1.redhat_00003.1.el8sso

redhatpatch availablevia redhat_api

Product: Red Hat Support for Spring Boot 2.5.10Fixed in: undertow

redhatpatch availablevia redhat_api

Product: RHEL-8 based Middleware ContainersFixed in: rh-sso-7/sso74-openshift-rhel8:7.4-44

redhatpatch availablevia redhat_api

Product: RHEL-8 based Middleware ContainersFixed in: rh-sso-7/sso74-openj9-openshift-rhel8:7.4-59

redhatpatch availablevia redhat_api

Product: RHEL-8 based Middleware ContainersFixed in: rh-sso-7/sso75-openshift-rhel8:7.5-16

redhatpatch availablevia redhat_api

Product: RHEL-8 based Middleware ContainersFixed in: rh-sso-7/sso7-rhel8-operator-bundle:7.5.1-8

redhatpatch availablevia redhat_api

Product: RHSSO 7.5.1Fixed in: undertow

redhatpatch availablevia redhat_api

Product: EAP 7.3 asyncFixed in: undertow

redhatvendor investigatingvia nvd_reference

Vendor Advisories (2)

mavenGHSA-339q-62wm-c39whigh

Undertow vulnerable to Denial of Service (DoS) attacks

redhatCVE-2021-3859Important

undertow: client side invocation timeout raised when calling over HTTP2

References

access.redhat.com / security/cve/CVE-2021-3859

Vendor Advisory

bugzilla.redhat.com / show_bug.cgi

Issue TrackingVendor Advisory

github.com / undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2

PatchThird Party Advisory

github.com / undertow-io/undertow/pull/1296

Third Party Advisory

issues.redhat.com / browse/UNDERTOW-1979

Issue TrackingPatchVendor Advisory

security.netapp.com / advisory/ntap-20221201-0004

Third Party Advisory