CVE-2026-28367

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28367", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-02-27T04:42:16.439Z", "datePublished": "2026-03-27T16:13:05.108Z", "dateUpdated": "2026-11-04T22:18:52.336Z"}, "containers": {"cna": {"title": "Undertow: undertow: request smuggling via `\\r\\r\\r` as a header block terminator", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\\r\\r\\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1.6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "io.undertow/undertow-core", "defaultStatus": "affected", "versions": [{"version": "2.3.24.SP2-redhat-00001", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-activemq-artemis", "defaultStatus": "affected", "versions": [{"version": "0:2.40.0-7.redhat_00015.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-eap-product-conf-parent", "defaultStatus": "affected", "versions": [{"version": "0:801.6.1-1.GA_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.3.24-3.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:8.1.6-7.GA_redhat_00010.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-activemq-artemis", "defaultStatus": "affected", "versions": [{"version": "0:2.40.0-7.redhat_00015.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-eap-product-conf-parent", "defaultStatus": "affected", "versions": [{"version": "0:801.6.1-1.GA_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.3.24-3.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:8.1.6-7.GA_redhat_00010.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel for Spring Boot 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_spring_boot:4"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow-core", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}, {"vendor": "Red Hat", "product": "Red Hat Data Grid 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "moditect", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "pki-core:10.6/resteasy", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "pki-deps:10.6/resteasy", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "resteasy", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat Fuse 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_fuse:7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "org.jberet-jberet-parent", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "org.jberet-jberet-parent", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "org.jboss.eap-jboss-eap-xp", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow-core", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat Process Automation 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_bpms:7"]}, {"vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:25125", "name": "RHSA-2026:25125", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:25126", "name": "RHSA-2026:25126", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-28367", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443260", "name": "RHBZ#2443260", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2025-08-27T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "Inconsistent Interpretation of HTTP Requests", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-444: Inconsistent Interpretation of HTTP Requests", "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, configure any proxy servers positioned in front of Undertow to strictly validate HTTP header terminations. Ensure that these proxies are configured to reject or normalize non-standard header block terminators, such as `\\r\\r\\r`, before forwarding requests to Undertow. This operational control helps prevent request smuggling attacks by ensuring that only properly formed HTTP requests reach the Undertow server."}], "timeline": [{"lang": "en", "time": "2026-02-27T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-08-27T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T22:18:52.336Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T13:27:40.351547Z", "id": "CVE-2026-28367", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:27:54.878Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T13:27:40.351547Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:27:49.899Z"}}], "cna": {"title": "Undertow: undertow: request smuggling via `\\r\\r\\r` as a header block terminator", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1.6", "versions": [{"status": "unaffected", "version": "2.3.24.SP2-redhat-00001", "lessThan": "*", "versionType": "rpm"}], "packageName": "io.undertow/undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.40.0-7.redhat_00015.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:801.6.1-1.GA_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.3.24-3.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:8.1.6-7.GA_redhat_00010.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.40.0-7.redhat_00015.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:801.6.1-1.GA_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.3.24-3.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:8.1.6-7.GA_redhat_00010.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:camel_spring_boot:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel for Spring Boot 4", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "vendor": "Red Hat", "product": "Red Hat Data Grid 8", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "moditect", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "pki-core:10.6/resteasy", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "pki-deps:10.6/resteasy", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "resteasy", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "packageName": "org.jberet-jberet-parent", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "org.jberet-jberet-parent", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "org.jboss.eap-jboss-eap-xp", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_bpms:7"], "vendor": "Red Hat", "product": "Red Hat Process Automation 7", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-02-27T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-08-27T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-08-27T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:25125", "name": "RHSA-2026:25125", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:25126", "name": "RHSA-2026:25126", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-28367", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443260", "name": "RHBZ#2443260", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, configure any proxy servers positioned in front of Undertow to strictly validate HTTP header terminations. Ensure that these proxies are configured to reject or normalize non-standard header block terminators, such as `\\r\\r\\r`, before forwarding requests to Undertow. This operational control helps prevent request smuggling attacks by ensuring that only properly formed HTTP requests reach the Undertow server."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\\r\\r\\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "Inconsistent Interpretation of HTTP Requests"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T22:18:52.336Z"}, "x_redhatCweChain": "CWE-444: Inconsistent Interpretation of HTTP Requests"}}, "cveMetadata": {"cveId": "CVE-2026-28367", "state": "PUBLISHED", "dateUpdated": "2026-11-04T22:18:52.336Z", "dateReserved": "2026-02-27T04:42:16.439Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-03-27T16:13:05.108Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1"], "defaultStatus": "affected", "packageName": "io.undertow/undertow-core", "product": "Red Hat JBoss Enterprise Application Platform 8.1.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.3.24.SP2-redhat-00001", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.40.0-7.redhat_00015.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.6.1-1.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-undertow", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.24-3.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.6-7.GA_redhat_00010.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.40.0-7.redhat_00015.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.6.1-1.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-undertow", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.24-3.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.6-7.GA_redhat_00010.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_spring_boot:4"], "defaultStatus": "affected", "packageName": "undertow-core", "product": "Red Hat build of Apache Camel for Spring Boot 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "affected", "packageName": "undertow-core", "product": "Red Hat Data Grid 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "moditect", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "pki-core:10.6/resteasy", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "pki-deps:10.6/resteasy", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "resteasy", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "undertow-core", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"], "defaultStatus": "affected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "defaultStatus": "affected", "packageName": "org.jberet-jberet-parent", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "defaultStatus": "affected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "org.jberet-jberet-parent", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "org.jboss.eap-jboss-eap-xp", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_bpms:7"], "defaultStatus": "affected", "packageName": "undertow-core", "product": "Red Hat Process Automation 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "affected", "packageName": "undertow-core", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "19B253BB-F6CE-400B-87EF-1DF1AFFC2445", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "06A6AC25-2E2D-4359-A806-CC0355513A20", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "7095200A-4DAC-4433-99E8-86CA88E1E4D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "AAD91726-93D9-4230-BF69-6A79B58E09E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "72A54BDA-311C-413B-8E4D-388AD65A170A", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0D8BC03A-4198-4488-946B-3F6B43962942", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*", "matchCriteriaId": "0A24CBFB-4900-47A5-88D2-A44C929603DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "20A6B40D-F991-4712-8E30-5FE008505CB7", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*", "matchCriteriaId": "8190B427-8350-43AE-8F54-6A40B701C95E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\\r\\r\\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Undertow. Un atacante remoto puede explotar esta vulnerabilidad enviando \u2019\\r\\r\\r\u2019 como un terminador de bloque de encabezado. Esto puede usarse para contrabando de solicitudes con ciertos servidores proxy, como versiones anteriores de Apache Traffic Server y Google Cloud Classic Application Load Balancer, lo que podr\u00eda llevar a acceso no autorizado o manipulaci\u00f3n de solicitudes web."}], "id": "CVE-2026-28367", "lastModified": "2026-11-04T23:17:26.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.8, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28367", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T13:27:40.351547Z", "version": "2.0.3"}}]}, "published": "2026-03-27T17:16:27.750", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:25125"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:25126"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-28367"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443260"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "Red Hat build of Apache Camel - HawtIO 4", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_apache_camel_-_hawtio", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Red Hat build of Apache Camel for Spring Boot 4", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_apache_camel_for_spring_boot", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Data Grid 8", "source": "cna", "vendor": "Red Hat"}, "product": "data_grid", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Fuse 7", "source": "cna", "vendor": "Red Hat"}, "product": "fuse", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Red Hat JBoss Enterprise Application Platform 7", "source": "cna", "vendor": "Red Hat"}, "product": "jboss_enterprise_application_platform", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "source": "cna", "vendor": "Red Hat"}, "product": "jboss_enterprise_application_platform_expansion_pack", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "Red Hat Process Automation 7", "source": "cna", "vendor": "Red Hat"}, "product": "process_automation", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "matching"}]}, "original": {"product": "Red Hat Single Sign-On 7", "source": "cna", "vendor": "Red Hat"}, "product": "red_hat_single_sign_on", "vendor": "redhat"}], "analysis": {"en": {"generated_at": "2026-04-10T15:22:31.660726+00:00", "value": {"mitigation_remediation": ["Apply the latest Red\u202fHat security update that includes a fixed version of Undertow.", "Configure any proxy servers or load balancers in front of Undertow to strictly validate HTTP header terminators, rejecting or normalizing non\u2011standard sequences such as `\\r\\r\\r`.", "If a proxy cannot be adjusted, isolate the affected services behind a firewall or network segmentation to limit exposure to potential smuggling traffic.", "Monitor HTTP traffic for abnormal header terminators and review logs for repeated smuggling attempts."], "summary": {"action": "Apply Patch", "impact": "Request Smuggling"}, "threat_synthesis": {"affected_systems": "Affected products include several Red\u202fHat distributions that embed Undertow, such as Red\u202fHat Enterprise Linux\u202f8,\u202f9 and\u202f10, Red\u202fHat Data\u202fGrid\u202f8, Red\u202fHat Fuse\u202f7, the JBoss Enterprise Application Platform\u202f7 and\u202f8 along with their Expansion Packs, Red\u202fHat Process Automation\u202f7, Red\u202fHat Single Sign\u2011On\u202f7, and Red\u202fHat builds of Apache Camel \u2013 HawtIO\u202f4 and Apache Camel for Spring Boot\u202f4. The specific versions impacted are not explicitly listed in the advisory, but the caveat applies to all releases that contain the vulnerable Undertow component before it receives an official fix from Red\u202fHat.", "description_and_impact": "The vulnerability resides in Undertow, where a remote attacker can send three consecutive carriage return characters (\\r\\r\\r) as the header block terminator. This malformed terminator is interpreted by some older HTTP gateway software as the end of the header section, allowing an attacker to split a single logical request into multiple physical requests. The resulting request smuggling can lead to unauthorized access or manipulation of web requests, enabling the attacker to bypass security controls, read or overwrite sensitive data, or trigger unintended operations. The weakness is classified as HTTP Request Smuggling (CWE\u2011444).", "risk_and_exploitability": "The issue carries a CVSS score of 8.7, indicating high severity, but the EPSS score of less than 1\u202f% suggests the likelihood of exploitation at this time is low. The vulnerability is not listed in CISA\u2019s KEV catalog, meaning no publicly known exploits have been documented. The attack requires a remote attacker to craft a request that uses the non\u2011standard \\r\\r\\r terminator and the traffic must pass through a proxy or load balancer that incorrectly parses headers, such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. Given the need for specific gateway behavior, exploitation success is contingent upon the presence of those intermediaries."}}}}, "created": "2026-03-27T20:28:10.077638+00:00", "updated": "2026-04-13T14:28:14.267906+00:00", "vendors": ["redhat", "redhat$PRODUCT$build_of_apache_camel_-_hawtio", "redhat$PRODUCT$build_of_apache_camel_for_spring_boot", "redhat$PRODUCT$data_grid", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$fuse", "redhat$PRODUCT$jboss_enterprise_application_platform", "redhat$PRODUCT$jboss_enterprise_application_platform_expansion_pack", "redhat$PRODUCT$process_automation", "redhat$PRODUCT$red_hat_single_sign_on"]}