A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-28369 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2443262 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
31 Mar 2026, 18:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat fuse
Redhat jboss Enterprise Application Platform Expansion Pack Redhat data Grid Redhat build Of Apache Camel - Hawtio Redhat Redhat process Automation Redhat jboss Enterprise Application Platform Redhat enterprise Linux Redhat single Sign-on Redhat undertow Redhat build Of Apache Camel For Spring Boot |
|
| CPE | cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:* |
|
| References | () https://access.redhat.com/security/cve/CVE-2026-28369 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2443262 - Issue Tracking, Vendor Advisory |
27 Mar 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-27 17:16
Updated : 2026-03-31 18:08
NVD link : CVE-2026-28369
Mitre link : CVE-2026-28369
CVE.ORG link : CVE-2026-28369
JSON object : View
Products Affected
redhat
- single_sign-on
- build_of_apache_camel_for_spring_boot
- enterprise_linux
- jboss_enterprise_application_platform
- undertow
- build_of_apache_camel_-_hawtio
- jboss_enterprise_application_platform_expansion_pack
- process_automation
- data_grid
- fuse
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')