A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://access.redhat.com/security/cve/CVE-2026-28367 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2443260 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.1 · redhatNVD modified 2026-10-14 17:18
Affected (CPE criteria) 10
cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*