Red Hat JBoss Core Services(JBCS) HTTP Server does not properly normalize the path component of a request URL contains dot-dot-semicolon(s) before forwarding to the backend server. For instance, JBCS forwards a request URL '/A/..;/B' to the backend server without proper URL normalization only if the path '/A' is mapped in the JBCS configuration. The flaw causes the path '/B' to be proxied to the client. But normally it must not be proxied.