CVE-2026-28368

CRITICAL

INFO Priority: 0.07 BB Relevance: 78/100

Published: 2026-03-27 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: High

I: High

A: None

Description

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

Weakness Classification (1)

CWE-444

Affected Software (11)

Vendor	Product	Version
redhat	build_of_apache_camel_-_hawtio	4.0
redhat	build_of_apache_camel_for_spring_boot	4.0
redhat	data_grid	8.0
redhat	enterprise_linux	9.0
redhat	fuse	7.0.0
redhat	jboss_enterprise_application_platform	7.0.0
redhat	jboss_enterprise_application_platform	8.0.0
redhat	jboss_enterprise_application_platform_expansion_pack	-
redhat	process_automation	7.0
redhat	single_sign-on	7.0
redhat	undertow	-