CVE-2026-28367: Undertow is Vulnerable to HTTP Request/Response Smuggling
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Other sources
Undertow allows \r\r\r as a header block terminator. This can be used for request smuggling with proxy servers that forwards this byte sequence, including older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.3.25.Final - Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.2.40.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28367?
The severity of CVE-2026-28367 is considered high due to its potential for exploiting request smuggling vulnerabilities.
How do I fix CVE-2026-28367?
To fix CVE-2026-28367, it is recommended to update Undertow to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-28367?
CVE-2026-28367 affects various Red Hat products, including Undertow, JBoss Enterprise Application Platform, and others using the affected software versions.
What kind of attack does CVE-2026-28367 enable?
CVE-2026-28367 enables remote attackers to perform request smuggling by using '\r\r\r' as a header block terminator.
Is CVE-2026-28367 a critical vulnerability?
Yes, CVE-2026-28367 is critical as it can lead to significant security issues including the possibility of unauthorized data access.