Request Smuggling Vulnerability in Undertow by Red Hat
CVE-2026-28369

8.7HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel For Spring Boot 4
Red Hat Build Of Apache Camel - Hawtio 4
Red Hat Data Grid 8
Red Hat Enterprise Linux 10
Vendor
CVE Published:
27 March 2026

What is CVE-2026-28369?

A vulnerability exists in Undertow where an HTTP request containing leading spaces in the first header line is improperly handled. This non-compliance with HTTP standards can be leveraged by remote attackers to execute request smuggling attacks. Such attacks may allow bypassing of security controls, unauthorized access to restricted data, or manipulation of web caches, leading to potential data exposure or unauthorized actions.

References

https://access.redhat.com/security/cve/CVE-2026-28369
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2443262
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.