AIKIDO-2026-10533
undertow-core is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
87
High Risk
This Affects:
undertow-coreTL;DR
A flaw was found in Undertow where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy allows a remote attacker to construct specially crafted requests that exploit inconsistent header interpretation, potentially bypassing security controls, causing web cache poisoning, and launching HTTP request smuggling attacks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
undertow-core is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in versions 0.0.1 - 2.3.24.Final.
How to fix this
There is no fix available yet, but there are PRs ready to merge and the fix will probably be released in version 2.4.0.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant