NetSight
IP …
high8.7

CVE-2026-28367

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

Impact

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

Affected packages

EcosystemPackageAffectedFixed in
mavenio.undertow:undertow-parent<= 2.3.23.Finalnone recorded

Affected products

VendorProductAffected versions
RedhatBuild Of Apache Camel - Hawtio
Version 4.0
RedhatBuild Of Apache Camel For Spring Boot
Version 4.0
RedhatData Grid
Version 8.0
RedhatFuse
Version 7.0.0
RedhatJboss Enterprise Application Platform
Versions 7.0.0, 8.0.0
RedhatJboss Enterprise Application Platform Expansion Pack
All versions
RedhatProcess Automation
Version 7.0
RedhatSingle Sign-On
Version 7.0
RedhatUndertow
All versions
Red HatRed Hat JBoss Enterprise Application Platform 8.1.6
All versions
Version patch: 2.3.24.SP2-redhat-00001
Red HatRed Hat JBoss Enterprise Application Platform 8.1 For RHEL 8
All versions
Versions patch: 0:8.1.6-7.GA_redhat_00010.1.el8eap, patch: 0:2.3.24-3.SP2_redhat_00001.1.el8eap, patch: 0:2.40.0-7.redhat_00015.1.el8eap, patch: 0:801.6.1-1.GA_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 For RHEL 9
All versions
Versions patch: 0:8.1.6-7.GA_redhat_00010.1.el9eap, patch: 0:2.40.0-7.redhat_00015.1.el9eap, patch: 0:801.6.1-1.GA_redhat_00001.1.el9eap, patch: 0:2.3.24-3.SP2_redhat_00001.1.el9eap
Red HatRed Hat Build Of Apache Camel For Spring Boot 4
All versions
Red HatRed Hat Data Grid 8
All versions

Weakness classification

CWE-444

References