CVE-2026-28368
A flaw was found in Undertow.
Published Mar 27, 2026 · updated Oct 14, 2026 · redhat build of apache camel - hawtio
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
Affected
- cpe redhat/build of apache camel - hawtio4.0
- cpe redhat/build of apache camel for spring boot4.0
- cpe redhat/data grid8.0
- cpe redhat/fuse7.0.0
- cpe redhat/jboss enterprise application platform7.0.0
- cpe redhat/jboss enterprise application platform8.0.0
- cpe redhat/jboss enterprise application platform expansion packversion unspecified
- cpe redhat/process automation7.0
Sources
- CVE.orgCVE-2026-28368
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-28368
30-day exploitation probability 0.9%
first.org - NIST NVDCVE-2026-28368
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smugg
nvd.nist.gov