CVE-2026-28368
Undertow: undertow: request smuggling via inconsistent header parsing
HIGH 8.7
At a glance
- Source
- NVD
- EPSS
- EPSS 0.73 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
Weaknesses (CWE)
- CWE-444 — Inconsistent Interpretation of HTTP Requests
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | redhat |
| CVSS 3.1 | HIGH 8.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-8v4x-mgvp-p658 — Undertow is Vulnerable to HTTP Request/Response Smuggling
European references
- ENISA EUVD · EUVD-2026-16696
- GCVE · GCVE-0-2026-28368
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Affected products
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |