CVE-2021-20220 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-20220 PUBLISHED

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.

EPSS 0.18% · 39.7th percentile

Risk Scores

EPSS Score

0.18%

39.7th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:25.10	undertow	2.3.18-1, 0, 2.3.18-2
Ubuntu:18.04:LTS	undertow	1.4.23-2build1, 1.4.23-1, 1.4.23-3
Ubuntu:24.04:LTS	undertow	2.3.8-2, 0
Ubuntu:20.04:LTS	undertow	2.0.27-1, 2.0.23-1, 2.0.28-1
Ubuntu:22.04:LTS	undertow	2.2.13-1, 2.2.8-1, 2.2.14-1
Ubuntu:16.04:LTS	undertow	1.3.5-1, 1.3.16-1, 1.3.11-1

Timeline

Feb 23, 2021 CVE Published
Feb 23, 2021 PoC Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Aug 23, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 22, 2022 CVE Updated
Feb 25, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jun 29, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2021-20220 third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1923133 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2021-20220 third-party-advisory

Open in Interactive Console →