CVE-2020-10687: Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)

September 23, 2020 (updated January 30, 2021)

A flaw was discovered in all versions of Undertow before Undertow Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

References

bugzilla.redhat.com/show_bug.cgi?id=1785049
nvd.nist.gov/vuln/detail/CVE-2020-10687

Code Behaviors & Features

Detect and mitigate CVE-2020-10687 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →