Critical severity · published Mar 27, 2026
CVE-2026-28367
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Data Grid 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8.1.6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform Expansion Pack · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Process Automation 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel for Spring Boot 4 · Red Hat
All versions, or not specified · source: vendor
BO
Build OF Apache Camel - Hawtio · Redhat
4.0 · source: NVD
Affected product
RH
Red Hat build of Apache Camel for Spring Boot 4
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28367
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:25125
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:25126
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-28367
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2443260
More from Red Hat build of Apache Camel for Spring Boot 4
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers
9.1
CVE-2026-28368
Undertow: undertow: request smuggling via inconsistent header parsing
8.2
CVE-2026-93569
Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
8.1
CVE-2026-84218
Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
7.5
CVE-2026-93568
Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests