What’s Vulnerable › Vulnerabilities

CVE-2021-31922

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-14 · updated 2026-06-17
• Weakness: CWE-444

Description

An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.

Affected products

• Pulsesecure Virtual Traffic Manager: through 18.1; from 18.3 through 19.1; 18.2, 18.2-r1, 19.2, 19.2-r1, 19.2-r2, 19.3 (+3)

References

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790

Get alerted when CVE-2021-31922 or the next vulnerability affects your stack