CVE-2026-28367: Red Hat Undertow request smuggling via malformed header terminator

CVE-2026-28367 · Severity: high · CVSS 8.7 · Published 2026-03-27

Undertow, a high-performance web server used in many Java applications, is vulnerable to a flaw that allows attackers to manipulate how web requests are processed. By sending specially crafted data, an attacker can 'smuggle' hidden requests past security filters or load balancers, potentially leading to unauthorized access to sensitive data or the ability to bypass security controls. This issue primarily affects environments using specific proxy servers like older versions of Apache Traffic Server or Google Cloud Load Balancers.

Technologies: io.undertow:undertow-parent (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-28367 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28367 being exploited in the wild.
How severe is CVE-2026-28367?
High severity, with a CVSS score of 8.7, published 27 March 2026.
Which products and versions are affected?
io.undertow:undertow-parent (Maven) <= 2.3.23.Final, ECOSYSTEM:introduced=0,last_affected=2.3.23.Final.
Is there a fix for CVE-2026-28367?
A patch was published on 2026-06-10: Red Hat released security updates (RHSA-2026:25125, RHSA-2026:25126) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28367 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28367?
Check whether you run io.undertow:undertow-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A request smuggling vulnerability (CWE-444) exists in Undertow due to inconsistent interpretation of HTTP request headers. Specifically, Undertow incorrectly allows the byte sequence `\r\r\r` to act as a header block terminator. When Undertow is deployed behind certain proxy servers or load balancers (such as older versions of Apache Traffic Server or Google Cloud Classic Application Load Balancer) that do not recognize this sequence as a terminator, an attacker can craft a request that is interpreted differently by the proxy and the backend server. This allows the attacker to 'smuggle' a second, hidden request inside the first one, leading to potential credential hijacking, security filter bypass, or unauthorized data access. The vulnerability is patched in Undertow 2.3.24.SP2 and incorporated into Red Hat JBoss EAP 8.1.6.

Affected products

  • Red Hat Undertow <= 2.3.23.Final
  • Red Hat JBoss Enterprise Application Platform 8.1

Identifiers

  • CVE-2026-28367
  • GHSA-3gv6-g396-9v4r

Timeline

  • 2026-02-27: disclosed: Initial report in Red Hat Bugzilla
  • 2026-03-27: advisory: GitHub and NVD advisory published
  • 2026-06-10: patched: Red Hat released security updates (RHSA-2026:25125, RHSA-2026:25126)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.