CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2020-10719
Medium (6.5). EPSS 1.0% chance of exploitation in the next 30 days. Fixed in io.undertow:undertow-core 2.1.1.Final.
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-444
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:active_iq_unified_manager
- netapp:oncommand_insight
- netapp:oncommand_workflow_automation
- redhat:fuse
- redhat:jboss_enterprise_application_platform
- redhat:openshift_application_runtimes
- redhat:single_sign-on
- redhat:undertow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cccf-7xw3-p2vr | Maven | io.undertow:undertow-core | <2.1.1.Final | 2.1.1.Final |