GHSA-p9w3-gwc2-cr49
HTTP Request Smuggling in Undertow
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.2.0.Final | 2.2.0.Final |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
References
External links from the advisory. They lead to third-party sites.