CVE-2020-27782: 
Java vulnerability analysis and mitigation

A flaw was found in the Undertow AJP connector where malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters. This vulnerability was discovered in 2020 and affects Undertow versions 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1 (NVD, Red Hat Bugzilla).

The vulnerability exists in the AJP connector's handling of query string characters. When processing certain non-RFC compliant characters in query strings, the AJP connector fails to properly validate the input, leading to improper handling and abrupt connection closures. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The primary impact of this vulnerability is on system availability. When exploited, it results in server errors and denial of service conditions. The vulnerability specifically affects the AJP connector, causing it to close sessions abruptly which can mark nodes as broken (Red Hat Bugzilla).

A temporary mitigation is available by using HTTP/1.1 instead of AJP to proxy to the back-end. The issue has been permanently fixed in Undertow versions 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1. Multiple Red Hat products have released security updates to address this vulnerability (Red Hat Bugzilla).