A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-28368 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2443261 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
31 Mar 2026, 18:20
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat fuse
Redhat jboss Enterprise Application Platform Expansion Pack Redhat data Grid Redhat build Of Apache Camel - Hawtio Redhat Redhat process Automation Redhat jboss Enterprise Application Platform Redhat enterprise Linux Redhat single Sign-on Redhat undertow Redhat build Of Apache Camel For Spring Boot |
|
| CPE | cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:* |
|
| References | () https://access.redhat.com/security/cve/CVE-2026-28368 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2443261 - Issue Tracking, Vendor Advisory |
27 Mar 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-27 17:16
Updated : 2026-03-31 18:20
NVD link : CVE-2026-28368
Mitre link : CVE-2026-28368
CVE.ORG link : CVE-2026-28368
JSON object : View
Products Affected
redhat
- single_sign-on
- build_of_apache_camel_for_spring_boot
- enterprise_linux
- jboss_enterprise_application_platform
- undertow
- build_of_apache_camel_-_hawtio
- jboss_enterprise_application_platform_expansion_pack
- process_automation
- data_grid
- fuse
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')