A flaw was found in Undertow.
Priority LOW 24CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 7 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Why it matters now
EPSS 0.012 68th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.1.6, 2.0.34Red Hat: 7 advisoriesRed Hat: 7 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | Undertow 2.2.0.Final, Undertow 2.1.6.Final, Undertow 2.0.34.Final | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | 2.1.0 to before 2.1.6 | 2.1.6 | Patch available | GHSA-qjwc-v72v-fq6r |
| — | io.undertow:undertow-core (Maven) | before 2.0.34 | 2.0.34 | Patch available | GHSA-qjwc-v72v-fq6r |
- undertow Vendor— Affected Undertow 2.2.0.Final, Undertow 2.1.6.Final, Undertow 2.0.34.Final Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected 2.1.0 to before 2.1.6 Fixed in 2.1.6 Patch available GHSA-qjwc-v72v-fq6r
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.0.34 Fixed in 2.0.34 Patch available GHSA-qjwc-v72v-fq6r
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* | before 2.0.34; 2.1.0 to before 2.1.6 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.0.34; 2.1.0 to before 2.1.6 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-qjwc-v72v-fq6r io.undertow:undertow-core (Maven) Fixed in 2.1.6 Advisory →
- Fix · GHSA-qjwc-v72v-fq6r io.undertow:undertow-core (Maven) Fixed in 2.0.34 Advisory →
Red Hat 7 advisories
- RHSA-2021:2755 Released 2021-07-15 · Red Hat rating ModerateEAP XP 2 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
- RHSA-2021:2210 Released 2021-06-02 · Red Hat rating ModerateEAP XP 1 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP via EAP 7.3.x base
- RHSA-2021:0974 Released 2021-03-23 · Red Hat rating ModerateRed Hat Single Sign-On 7.4.6 security update
- Red Hat Single Sign-On 7.4.6
Show 4 more Red Hat advisories
- RHSA-2021:0872 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el6eap +47
- RHSA-2021:0874 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el8eap +47
- RHSA-2021:0873 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el7eap +47
- RHSA-2021:0885 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss Enterprise Application Platform 7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat EAP-XP 2.0.0 via EAP 7.3.x base | Fixed | RHSA-2021:2755 |
| Red Hat EAP-XP via EAP 7.3.x base | Fixed | RHSA-2021:2210 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2021:0874 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2021:0872 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2021:0873 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2021:0885 |
| Red Hat Single Sign-On 7.4.6 | Fixed | RHSA-2021:0974 |
Not affected: 3 products
- Red Hat Decision Manager 7
- Red Hat Fuse 7
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20220
- 2026-10-03 Alias added: GHSA-qjwc-v72v-fq6r
References
Advisory 3
Sources
- CVE-2021-20220 · CVE Program
- CVE-2021-20220 · NVD
- FIRST EPSS
- GHSA-qjwc-v72v-fq6r · GitHub Advisory Database · CC BY 4.0
- CVE-2021-20220 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences