CVE-2026-28369: Red Hat Undertow request smuggling via malformed HTTP headers

CVE-2026-28369 · Severity: high · CVSS 8.7 · Published 2026-03-27

Undertow, a high-performance web server used in many Java applications, is vulnerable to a security flaw that allows attackers to 'smuggle' malicious web requests. By sending specially formatted messages that include unexpected spaces in the header, an attacker can trick the server into misinterpreting where one request ends and the next begins. This can lead to unauthorized access to sensitive data, the bypassing of security controls, or the corruption of web caches.

Technologies: io.undertow:undertow-parent (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-28369 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28369 being exploited in the wild.
How severe is CVE-2026-28369?
High severity, with a CVSS score of 8.7, published 27 March 2026.
Which products and versions are affected?
io.undertow:undertow-parent (Maven) <= 2.3.23.Final, ECOSYSTEM:introduced=0,last_affected=2.3.23.Final.
Is there a fix for CVE-2026-28369?
A patch was published on 2026-06-10: Red Hat released RHSA-2026:25125 and RHSA-2026:25126 fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28369 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28369?
Check whether you run io.undertow:undertow-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Undertow (CWE-444) due to inconsistent interpretation of HTTP requests. When Undertow receives an HTTP request where the first header line begins with one or more spaces, it incorrectly strips these spaces instead of rejecting the message. While HTTP standards allow 'obs-fold' (concatenating lines starting with spaces into the previous line), this is invalid for the first header line as there is no preceding line. A remote attacker can exploit this behavior to perform request smuggling, potentially bypassing security filters or accessing restricted resources. The issue is addressed in Undertow version 2.3.24.SP2 and Red Hat JBoss EAP 8.1.6.

Affected products

  • Red Hat Undertow <= 2.3.23.Final
  • Red Hat JBoss Enterprise Application Platform 8.1

Identifiers

  • CVE-2026-28369
  • GHSA-vqqj-9cmv-hx43

Timeline

  • 2026-02-27: other: Issue reported to Red Hat Bugzilla
  • 2026-03-27: disclosed: CVE-2026-28369 published
  • 2026-03-27: advisory: GitHub Advisory GHSA-vqqj-9cmv-hx43 published
  • 2026-06-10: patched: Red Hat released RHSA-2026:25125 and RHSA-2026:25126 fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.