High severity · published Mar 12, 2018
CVE-2016-9589
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service
7.5
CVSS
3%
EPSS
No
On KEV
Description
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JW
Jboss Wildfly Application Server · Redhat
through 10.1.0; 11.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9589
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9589
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0830.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0831.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0832.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0834.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0876.html
Third Party Advisory
http://www.securityfocus.com/bid/97060
More from Jboss Wildfly Application Server
7.5
CVE-2015-3198
The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL
7.5
CVE-2016-0793
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote…
6.1
CVE-2016-4993
CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers…
5.5
CVE-2018-1047
A flaw was found in Wildfly 9.x
–
CVE-2015-5220
The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service…