VulnerabilityModified
CVE-2026-28367
A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator.
CRITICAL 9.1EPSS 0.71%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.71% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-444
- Affected
- redhat/build of apache camel - hawtio · redhat/build of apache camel for spring boot · redhat/data grid · redhat/fuse · redhat/jboss enterprise application platform · redhat/jboss enterprise application platform expansion pack · redhat/process automation · redhat/single sign-on · redhat/undertow
- Source
- secalert@redhat.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.