CVE-2021-20220

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.

• CWE-444
• CWE-444

• https://bugzilla.redhat.com/show_bug.cgi?id=1923133Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220210-0013/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1923133Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220210-0013/Third Party Advisory

Published

Feb 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20215A flaw was found in Privoxy in versions before 3.0.29. Memor…7.5
• CVE-2021-20216A flaw was found in Privoxy in versions before 3.0.31. A mem…7.5
• CVE-2021-20217A flaw was found in Privoxy in versions before 3.0.31. An as…7.5
• CVE-2021-20218A flaw was found in the fabric8 kubernetes-client in version…7.4
• CVE-2021-20219A denial of service vulnerability was found in n_tty_receive…5.5
• CVE-2021-2022Vulnerability in the MySQL Server product of Oracle MySQL (c…4.4
• CVE-2021-20221An out-of-bounds heap buffer access issue was found in the A…6
• CVE-2021-20222A flaw was found in keycloak. The new account console in key…7.5
• CVE-2021-20223Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20224An integer overflow issue was discovered in ImageMagick's Ex…5.5
• CVE-2021-20225A flaw was found in grub2 in versions prior to 2.06. The opt…6.7
• CVE-2021-20226A use-after-free flaw was found in the io_uring in Linux ker…7.8