-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.undertow:undertow-core | maven | < 2.2.32.Final | 2.2.32.Final |
| io.undertow:undertow-core | maven | >= 2.3.0.Alpha1, < 2.3.13.Final | 2.3.13.Final |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how sessions were created and managed during form authentication. The patch adds session timeout constraints (2 minutes) for newly created authentication sessions and restores original timeouts post-authentication. The original storeInitialLocation functions in both classes created sessions with default configurations, enabling attackers to trigger OOM errors by creating excessive sessions. The commit diff clearly shows these functions were modified to add session timeout controls, confirming their role in the vulnerability.
JavaJavaOngoing coverage of React2Shell