Executive brief
Undertow, a high-performance web server used in many Java applications, is vulnerable to a security flaw that allows attackers to 'smuggle' malicious web requests. By sending specially formatted messages that include unexpected spaces in the header, an attacker can trick the server into misinterpreting where one request ends and the next begins. This can lead to unauthorized access to sensitive data, the bypassing of security controls, or the corruption of web caches.
Technical details
A vulnerability exists in Undertow (CWE-444) due to inconsistent interpretation of HTTP requests. When Undertow receives an HTTP request where the first header line begins with one or more spaces, it incorrectly strips these spaces instead of rejecting the message. While HTTP standards allow 'obs-fold' (concatenating lines starting with spaces into the previous line), this is invalid for the first header line as there is no preceding line. A remote attacker can exploit this behavior to perform request smuggling, potentially bypassing security filters or accessing restricted resources. The issue is addressed in Undertow version 2.3.24.SP2 and Red Hat JBoss EAP 8.1.6.
Affected products
- Red Hat Undertow <= 2.3.23.Final
- Red Hat JBoss Enterprise Application Platform 8.1
Timeline
- 2026-02-27: other: Issue reported to Red Hat Bugzilla
- 2026-03-27: disclosed: CVE-2026-28369 published
- 2026-03-27: advisory: GitHub Advisory GHSA-vqqj-9cmv-hx43 published
- 2026-06-10: patched: Red Hat released RHSA-2026:25125 and RHSA-2026:25126 fixes