-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.undertow:undertow-core | maven | >= 2.1.0, <= 2.2.8.Final | 2.2.9.Final |
| io.undertow:undertow-core | maven | <= 2.0.38.Final | 2.0.39.Final |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly implicates HTTP2SourceChannel in failing to write final frames. The CWE-362 classification indicates a race condition from improper synchronization. The write method in HTTP2SourceChannel is the primary point where frame transmission logic would handle final frames. Without proper synchronization mechanisms (e.g., locks or atomic operations), concurrent access could prevent the final frame from being written, matching the described DoS scenario. While exact patch details are unavailable, the class/method mentioned directly aligns with the vulnerability's technical description.
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report