CVE-2021-31922: Pulse Secure Virtual Traffic Manager

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.

Affected products

• Pulse Secure Virtual Traffic Manager: up to and including 18.1; from 18.3, up to and including 19.1; version 18.2 only; version 19.2 only; version 19.3 only; version 20.1 only; …

Published 2021-05-14. Last modified 2026-06-17.