Medium severity4.8NVD Advisory· Published Feb 23, 2021· Updated Jun 17, 2026
CVE-2021-20220
CVE-2021-20220
Description
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.undertow:undertow-coreMaven | >= 2.1.0, < 2.1.6 | 2.1.6 |
io.undertow:undertow-coreMaven | < 2.0.34 | 2.0.34 |
Affected products
2- Undertow/Undertowdescription
Patches
Vulnerability mechanics
References
6- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-qjwc-v72v-fq6rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-20220ghsaADVISORY
- security.netapp.com/advisory/ntap-20220210-0013/nvdThird Party Advisory
- github.com/undertow-io/undertow/commit/9e797b2f99617fdad0471eaa88c711ee7f44605fghsaWEB
- security.netapp.com/advisory/ntap-20220210-0013ghsaWEB
News mentions
0No linked articles in our index yet.