CVE-2026-28367 Details
Description
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
A request smuggling vulnerability has been identified in Undertow. This issue arises because Undertow allows the use of `\r\r\r` as a header block terminator. When this non-standard termination is forwarded by certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, it can be exploited by remote attackers. The exploitation could lead to unauthorized access or manipulation of web requests.
To mitigate this vulnerability, configure any proxy servers in front of Undertow to validate HTTP header terminations. Proxies should reject or normalize non-standard header block terminators like `\r\r\r` before forwarding requests to Undertow. This ensures that only properly formed HTTP requests reach the server, preventing request smuggling attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redhat build of apache camel - hawtio | 4.0 |
CPE
Remediation
| |
| redhat build of apache camel for spring boot | 4.0 |
CPE
Remediation
| |
| redhat data grid | 8.0 |
CPE
Remediation
| |
| redhat fuse | 7.0.0 |
CPE
Remediation
| |
| redhat jboss enterprise application platform | 7.0.0 8.0.0 |
CPE
Remediation
| |
| redhat jboss enterprise application platform expansion pack | All versions |
CPE
Remediation
| |
| redhat process automation | 7.0 |
CPE
Remediation
| |
| redhat single sign-on | 7.0 |
CPE
Remediation
| |
| redhat undertow | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | [email protected] |
| Jun 29, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 10, 2026 | CVE Modified | [email protected] |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |