What’s Vulnerable › Vulnerabilities
CVE-2026-28369: Undertow: undertow: request smuggling via malformed http request headers
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-27 · updated 2026-10-26
- Weakness: CWE-444
Description
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
Affected products
- RedHat Build Of Apache Camel - Hawtio: 4.0
- RedHat Build Of Apache Camel For Spring Boot: 4.0
- RedHat Data Grid: 8.0
- Red Hat Enterprise Linux: 9.0
- Red Hat Fuse: 7.0.0
- Red Hat JBoss EAP: 7.0.0, 8.0.0
- RedHat Jboss Enterprise Application Platform Expansion Pack: all versions
- RedHat Process Automation: 7.0
- Red Hat Single Sign-On: 7.0
- Red Hat undertow: all versions
References
- https://access.redhat.com/errata/RHSA-2026:25125
- https://access.redhat.com/errata/RHSA-2026:25126
- https://access.redhat.com/security/cve/CVE-2026-28369
- https://bugzilla.redhat.com/show_bug.cgi?id=2443262
Get alerted when CVE-2026-28369 or the next vulnerability affects your stack