CVE-2021-22113

Name of the Vulnerable Software and Affected Versions Spring Cloud Netflix Zuul versions 2.2.6.RELEASE and below

Description The issue allows bypassing the "Sensitive Headers" restriction when executing requests with specially constructed URLs. Applications using Spring Security's StrictHttpFirewall are not affected, as they reject requests that allow bypassing.

Recommendations For Spring Cloud Netflix Zuul versions 2.2.6.RELEASE and below, consider disabling the "Sensitive Headers" functionality until a patch is available. As a temporary workaround, enable Spring Security's StrictHttpFirewall to reject requests that allow bypassing the "Sensitive Headers" restriction. At the moment, there is no information about a newer version that contains a fix for this vulnerability.