CVE-2016-9589 | BDVDB-2026-97677 Detail
Red Hatwildfly
Description#
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.
Impact#
No impact statement in the source data.
Weaknesses#
- CWE-400 Uncontrolled Resource Consumption
References#
- http://rhn.redhat.com/errata/RHSA-2017-0831.html
- http://rhn.redhat.com/errata/RHSA-2017-0876.html
- http://rhn.redhat.com/errata/RHSA-2017-0834.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1404782
- https://access.redhat.com/errata/RHSA-2017:3458
- http://rhn.redhat.com/errata/RHSA-2017-0832.html
- http://www.securityfocus.com/bid/97060
- https://access.redhat.com/errata/RHSA-2017:3455
- https://access.redhat.com/errata/RHSA-2017:3456
- https://access.redhat.com/errata/RHSA-2017:0873
- https://access.redhat.com/errata/RHSA-2017:3454
- http://rhn.redhat.com/errata/RHSA-2017-0830.html
- https://access.redhat.com/errata/RHSA-2017:0872
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.