CVE-2021-20220: Netapp Active Iq Unified Manager

Medium severity, CVSS 4.8. EPSS: 1.2% chance of exploitation in the next 30 days.

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected products

• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Red Hat Undertow: before 2.0.34 (fixed in 2.0.34); from 2.1.0, before 2.1.6 (fixed in 2.1.6)

Published 2021-02-23. Last modified 2026-06-17.