Consider the following web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
	version="4.0">

	<servlet>
		<servlet-name>ErrorHandler</servlet-name>
		<servlet-class>ErrorHandler</servlet-class>
	</servlet>
	<servlet-mapping>
		<servlet-name>ErrorHandler</servlet-name>
		<url-pattern>/ErrorHandler</url-pattern>
	</servlet-mapping>

	<error-page>
		<exception-type>java.lang.Exception</exception-type>
		<location>/ErrorHandler</location>
	</error-page>

</web-app>

The `ErrorHandler` servlet received an incorrect value when calling `HttpServletRequest.getAttribute(RequestDispatcher.INCLUDE_MAPPING)` after forwarded by <error-page/> definition in web.xml.
It is expected to erase the request attributes of `RequestDispatcher.INCLUDE_*` of `ErrorHandler` servlet but it incorrectly returned the servlet mapping info which the original error happened before forwarding.

Checked with Tomcat 11.0.1 and Jetty 12.0.15 which they correctly erased `RequestDispatcher.INCLUDE_*` request attributes after forwarded by <error-page/>, so suspected this should be a bug in Undertow.

Attached sample war for reproduce this issue ( UNDERTOW-2536.war ).
Accessing http://localhost:8080/UNDERTOW-2536/ will trigger exception and forward to `ErrorHandler` servlet, which just print the servlet mapping info.
Expecting to print `mapping 'HttpServletRequest.getAttribute(RequestDispatcher.INCLUDE_MAPPING)': null` in the server log but actually got `mapping 'HttpServletRequest.getAttribute(RequestDispatcher.INCLUDE_MAPPING)': { servletName: jsp, pattern: *.jsp, mappingMatch: EXTENSION, matchValue: index }`