Undertow Request Smuggling Vulnerability Due to Inconsistent Header Parsing

A request smuggling vulnerability has been identified in Undertow. This issue arises from a flaw in how Undertow parses header names in comparison to upstream proxies. The discrepancy allows remote attackers to craft requests that exploit this inconsistency, potentially bypassing security controls and accessing unauthorized resources. When deployed behind an upstream proxy, Undertow's header interpretation can be manipulated to smuggle requests, leading to unauthorized access or cache poisoning.

Impact

Exploitation of this vulnerability can cause request smuggling, allowing attackers to bypass security controls and access unauthorized resources. This could also lead to web cache poisoning, where cached content is manipulated to serve malicious data.