CVE-2020-10687

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.2.0.Final

Description A flaw was discovered in Undertow that allows HTTP request smuggling against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This issue can be exploited to poison a web-cache, perform a cross-site scripting (XSS) attack, or obtain sensitive information from requests other than the attacker's own.

Recommendations For versions prior to 2.2.0.Final, update to Undertow 2.2.0.Final to resolve the issue. As a temporary workaround, consider restricting HTTP requests to prevent invalid characters from being processed until a patch is available.