-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.undertow:undertow-core | maven | <= 2.0.39.Final | 2.0.40.Final |
| io.undertow:undertow-core | maven | >= 2.1.0, <= 2.2.10.Final | 2.2.11.Final |
Miggo AIRoot Cause AnalysisThe vulnerability centers on HTTP/2 flow control mishandling. Analysis of Undertow's architecture indicates that: 1) Http2Channel is the primary handler for HTTP/2 frame processing 2) Data frame handling directly impacts flow control state 3) Stream-level processing (Http2StreamChannel) would enforce per-stream flow control. While exact patch details aren't available, the vulnerability description and HTTP/2 protocol mechanics strongly suggest these core frame processing functions would be involved in the insecure resource management. The high confidence for handleDataFrame() stems from its central role in processing DATA frames which are directly related to flow control consumption.