CVE-2020-10687 — HTTP Request Smuggling in Undertow

Description

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

Affected products

Vendor	Product	Affected	Fixed
—	Undertow	Undertow 2.2.0.Final	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	undertow	2.2.0-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	undertow	No fix yet	—
Ubuntu 26.04 LTS	undertow	No fix yet	—
Ubuntu 25.10	undertow	No fix yet	—

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 24.04 LTS	undertow	No fix yet	—
Ubuntu Pro 20.04 LTS	undertow	No fix yet	—
Ubuntu Pro 18.04 LTS	undertow	No fix yet	—
Ubuntu Pro 16.04 LTS	undertow	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.9.0-9.redhat_00019.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-bouncycastle +3	1.68.0-1.redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-dom4j	2.1.3-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.2.5-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-13.SP3_redhat_00011.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-guava +1	30.1.0-1.redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-guava-failureaccess	1.0.1-1.redhat_00002.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-hal-console	3.0.23-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.17-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.19-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.22-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.39-1.SP1_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-genericjms	2.0.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-7.SP2_redhat_00005.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.15-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-modules	1.8.10-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.20-2.SP1_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-13.Final_redhat_00014.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-server-migration-eap7.3-server +6	1.7.1-7.Final_redhat_00009.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.7.6-4.SP3_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-narayana +10	5.9.11-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-netty +1	4.1.48-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-resteasy +19	3.6.1-10.SP9_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-undertow	2.0.30-4.SP4_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.0.6-4.Final_redhat_00004.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.9-4.GA_redhat_00003.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-common	1.5.2-1.Final_redhat_00002.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.6.8-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-elytron-tool	1.10.7-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.22-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.9-4.GA_redhat_00003.1.el7eap	RHSA-2021:0873, RHSA-2020:3638, RHSA-2020:3462
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.14-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.11-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	io.undertow:undertow-core	< 2.2.0.Final	2.2.0.Final	GHSA-p9w3-gwc2-cr49

Advisories 11

RHSA-2021:0873 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:0874 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:0872 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2022-1912 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025
WID-SEC-2023-1272 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025

HTTP Request Smuggling in Undertow

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

Affected packages

Advisories 11

References