CVE-2020-10705

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	Undertow	Versions before Undertow 2.1.1.Final.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1803241Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20220210-0014/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1803241Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20220210-0014/Third Party Advisory

Timeline

Published: Jun 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-107066.6A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This f CVE-2020-107097.1A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provi CVE-2020-10716.8An elevation of privilege vulnerability exists when Windows improperly handles errors tied to Remote Access Common Dialog. An attacker who s CVE-2020-107104.4A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This CVE-2020-107115.9A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing t CVE-2020-107128.2A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry o CVE-2020-107138.2A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. Th CVE-2020-107147.5A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the CVE-2020-107154.3A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arb CVE-2020-107166.5A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allo CVE-2020-107176.5A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs CVE-2020-107187.5A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Threa