{"id":"CVE-2016-9589","details":"Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to \"max-headers\" (default 200) * \"max-header-size\" (default 1MB) per active TCP connection.","aliases":["GHSA-p4xg-cpr9-vwvj"],"modified":"2026-07-08T12:53:31.887495Z","published":"2018-03-12T15:29:00.273Z","references":[{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0830.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0831.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0832.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0834.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0876.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/97060"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:0872"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:0873"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3455"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3458"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404782"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wildfly/wildfly","events":[{"introduced":"0"},{"last_affected":"c3332cec0c9bc5dc57899c2ae7ba26dd0c627686"},{"introduced":"1299aae21ee19d2dc2f174b09b3d74e4faec7f9b"},{"last_affected":"1299aae21ee19d2dc2f174b09b3d74e4faec7f9b"}],"database_specific":{"cpe":["cpe:2.3:a:redhat:jboss_wildfly_application_server:*:*:*:*:*:*:*:*","cpe:2.3:a:redhat:jboss_wildfly_application_server:11.0.0:alpha1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"10.1.0"},{"introduced":"11.0.0-alpha1"},{"last_affected":"11.0.0-alpha1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["11.0.0-alpha1","11.0.0.Alpha1","10.1.0.Final","10.1.0.CR1","10.0.0.Final","10.0.0.CR5","10.0.0.CR4","10.0.0.CR3","10.0.0.CR2","10.0.0.CR1","10.0.0.Beta2","10.0.0.Beta1","10.0.0.Alpha6","10.0.0.Alpha5","10.0.0.Alpha4","10.0.0.Alpha3","10.0.0.Alpha2","10.0.0.Alpha1","9.0.0.CR1","9.0.0.Beta2","9.0.0.Beta1","8.1.0.CR2","8.1.0.CR1","8.0.0.Final","8.0.0.CR1","8.0.0.Beta1","8.0.0.Alpha4","8.0.0.Alpha3","8.0.0.Alpha2","8.0.0.Alpha1","7.2.0.Final-prerelease1","7.2.0.Final","7.1.2.Final","7.1.2-prerelease","7.1.1.Final","7.1.0.Final","7.1.0.Final-prerelease2","7.1.0.Final-prerelease","7.1.0.CR1","7.1.0.Beta1","7.1.0.Alpha1","7.0.0.Final","7.0.0.Final-prerelease3","7.0.0.Final-prerelease2","7.0.0.Final-prerelease","7.0.0.CR1","7.0.0.Beta3","7.0.0.Beta2","7.0.0.Beta2-prerelease","7.0.0.Beta1-prerelease","7.0.0.Alpha1-final","7.0.0.Alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9589.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}