Описание
[REJECTED CVE] A vulnerability has been identified in the Undertow package where the readHpackString method may incorrectly reuse an HTTP request header value from a previous stream for a new request on the same HTTP/2 connection due to improper handling of the stringBuilder field. While this typically results in an error and connection termination, an attacker could potentially exploit this flaw to leak sensitive information between requests within the same connection.
Отчет
Red Hat Product Security does not consider this bug to be a security vulnerability. It has been marked as REJECTED.
Дополнительная информация
0 Low
CVSS3
Связанные уязвимости
Rejected reason: Red Hat Product Security has determined that this CVE is not a security vulnerability.
Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse
0 Low
CVSS3