{"id":"CVE-2016-7046","published":"2016-10-03T21:00:00Z","modified":"2024-08-06T01:50:47Z","title":"Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes…","vendor":null,"product":null,"tier":"tail","description":{"text":"Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0248,"percentile":0.84534,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2640.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3458","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2642.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3455","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2657.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3456","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1376646","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3454","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2641.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/93173","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":16.9,"factors":[{"name":"EPSS percentile","points":16.91}]},"affected":[{"ecosystem":"Maven","package":"io.undertow:undertow-core","vulnerableRanges":[">=1.4.0, <1.4.3.Final","<1.3.25.Final"],"patched":["1.4.3.Final","1.3.25.Final"],"from":["GHSA-3f57-w2rp-72fc"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2166","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-undertow-cve-2016-4993","parents":[{"from":"CVE-2016-4993","to":"CVE-2016-7046","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/protocols/http2/HpackEncoder.java"],"commits":["https://github.com/undertow-io/undertow/commit/834496fb74ddda2af197940c70d08bab419fdf12","https://github.com/undertow-io/undertow/commit/c518b5a1784061d807efedcef0a03fcd35a53de2"],"basis":"shared function","functions":["encode"]}]}],"children":[{"from":"CVE-2016-7046","to":"CVE-2021-3859","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/protocols/http2/HpackEncoder.java"],"commits":["https://github.com/undertow-io/undertow/commit/c518b5a1784061d807efedcef0a03fcd35a53de2","https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2","https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8"],"basis":"shared function","functions":["encode"]}]}],"packageHistory":[{"cve":"CVE-2014-7816","published":"2014-12-01","fixed":"1.2.0.Beta3","kev":false,"link":{"from":"CVE-2014-7816","to":"CVE-2016-7046","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.2.0.Beta3","toFixed":"1.3.25.Final","daysApart":672}]}},{"cve":"CVE-2017-2670","published":"2018-07-27","fixed":"1.3.28","kev":false,"link":{"from":"CVE-2016-7046","to":"CVE-2017-2670","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.3.25.Final","toFixed":"1.3.28","daysApart":662}]}},{"cve":"CVE-2016-7046","published":"2016-10-03","fixed":"1.4.3.Final","kev":false},{"cve":"CVE-2017-2666","published":"2018-07-27","fixed":"1.4.17","kev":false,"link":{"from":"CVE-2016-7046","to":"CVE-2017-2666","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.4.3.Final","toFixed":"1.4.17","daysApart":662}]}},{"cve":"CVE-2017-7559","published":"2018-01-10","fixed":"2.0.0.Alpha2","kev":false},{"cve":"CVE-2017-12165","published":"2018-07-27","fixed":"2.0.0.Beta1","kev":false,"link":{"from":"CVE-2016-7046","to":"CVE-2017-12165","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.4.3.Final","toFixed":"1.4.17","daysApart":662}]}}],"package":"Maven:io.undertow:undertow-core"}}