HTTP request smuggling via invalid characters

HTTP request smuggling in Red Hat Undertow 2.2.0.Final, 2.1.6.Final and 2.0.34.Final allows remote attackers to poison caches, trigger XSS, or obtain other users' data via HTTP/1.x or HTTP/2 requests. The HTTP request parser accepts invalid characters in request targets, schemes, authorities, and methods; the corrective commit adds strict character validation for these fields in both HTTP/1.x and HTTP/2 handling. Exploitation requires a network path through a proxy or cache that interprets the malformed request differently, enabling cache poisoning, cross-request data disclosure, or XSS.