GHSA-p9w3-gwc2-cr49MediumCVSS 4.8

HTTP Request Smuggling in Undertow

Published
April 30, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-10687 →

📋 Description

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

🎯 Affected products1

  • maven/io.undertow:undertow-core:<= 2.1.0.Final

🔗 References (5)