Undertow, a web server component, is vulnerable to HTTP request smuggling due to improper handling of HTTP headers that start with leading spaces. This flaw allows remote attackers to bypass security controls, access restricted information, or manipulate web caches. The vulnerability affects versions prior to 2.2.40.Final and versions from 2.3.0.Final up to but not including 2.3.25.Final. A high-severity fix is available and has been released by Red Hat in their JBoss Enterprise Application Platform 8.1 updates.