A vulnerability in Undertow allows remote attackers to craft HTTP requests with header names parsed inconsistently between Undertow and upstream proxies. This discrepancy enables HTTP request smuggling attacks that can bypass security controls and access unauthorized resources. The flaw affects versions prior to 2.2.40.Final and versions from 2.3.0.Final up to but not including 2.3.25.Final. Fixes are available in versions 2.2.40.Final and 2.3.25.Final. Red Hat has issued security advisories with patches for affected JBoss Enterprise Application Platform versions.