CVE-2026-28367
A flaw was found in Undertow.
Published Mar 27, 2026 · updated Oct 14, 2026 · redhat build of apache camel - hawtio
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Affected
- cpe redhat/build of apache camel - hawtio4.0
- cpe redhat/build of apache camel for spring boot4.0
- cpe redhat/data grid8.0
- cpe redhat/fuse7.0.0
- cpe redhat/jboss enterprise application platform7.0.0
- cpe redhat/jboss enterprise application platform8.0.0
- cpe redhat/jboss enterprise application platform expansion packversion unspecified
- cpe redhat/process automation7.0
Sources
- CVE.orgCVE-2026-28367
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-28367
30-day exploitation probability 0.9%
first.org - NIST NVDCVE-2026-28367
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application
nvd.nist.gov