CVE-2021-3690: Red Hat Fuse

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Affected products

• Red Hat Fuse: version 1.0 only
• Red Hat Integration Camel K: affected versions not specified
• Red Hat Integration Camel Quarkus: affected versions not specified
• Red Hat JBoss Enterprise Application Platform: affected versions not specified; version 7.3 only; version 7.4 only
• Red Hat Openshift Application Runtimes: affected versions not specified
• Red Hat Single Sign-On: affected versions not specified
• Red Hat Undertow: before 2.0.40 (fixed in 2.0.40); from 2.1.0, before 2.2.10 (fixed in 2.2.10)

Published 2022-08-23. Last modified 2026-06-17.