This article is about protecting non-Pulse servers with Pulse WAF. For vulnerability status of Pulse products, see separate KB45117.
PulseSecure Web Application Firewall Module can help protect back-end application from CVE-2022-22963. For that, add a "RequiredHeaderFieldHandler" to the respective application and path, and set following as "invalid_header_pattern":
spring.cloud.function.routing-expression:.*
