Uncontrolled Recursion SNYK-JAVA-IOUNDERTOW-7433720

[github-actions]

Overview

io.undertow:undertow-core is a Java web server based on non-blocking IO.

Affected versions of this package are vulnerable to Uncontrolled Recursion in chunked response handling. An attacker can cause a client to wait indefinitely by sending excessive data without a 0\r\n termination sequence in chunked responses, thereby disrupting service to the server.

Note: This is only exploitable when using NewSessionTicket functionality in TLS 1.3 on Java 17.

Remediation

There is no fixed version for io.undertow:undertow-core.

References

• Red Hat Bugzilla Bug
• Red Hat Security Advisory