CVE-2026-28369 Details

A request smuggling vulnerability has been identified in Undertow. The issue arises when the server receives an HTTP request with the first header line starting with one or more spaces. Undertow improperly processes these requests by removing the leading spaces, creating a loophole that can be exploited by remote attackers. This behavior contradicts HTTP standards, as the specifications allow such leading spaces to be concatenated into the previous header line's value, except for the first line. Exploiting this flaw can enable attackers to bypass security measures, access restricted information, manipulate web caches, and potentially execute unauthorized actions or expose sensitive data.