Undertow Denial-of-Service Vulnerability in Multiple NetApp Products

A denial-of-service vulnerability has been identified in Undertow, a web server component used in various NetApp products. This issue arises because the HTTP2SourceChannel does not properly write the final frame in certain situations, leading to a denial-of-service condition. The vulnerability affects Undertow versions prior to 2.0.35.SP1, 2.2.6.SP1, 2.2.7.SP1, 2.0.36.SP1, 2.2.9.Final, and 2.0.39.Final.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition, disrupting the availability of the application or service using the affected Undertow version.

Remediation

This vulnerability has been addressed in Undertow versions 2.0.35.SP1, 2.2.6.SP1, 2.2.7.SP1, 2.0.36.SP1, 2.2.9.Final, and 2.0.39.Final. Users should upgrade to one of these versions.