CVE-2026-28367
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
8.7 HighFix available
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
0.72%Up 0.7 points since Mar 28, 2026
What each source reports
CVE List Score used
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- Record
CVE-2026-28367- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-04
EUVDEUVD-2026-16694
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- Record
EUVD-2026-16694- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-3gv6-g396-9v4r
Undertow is Vulnerable to HTTP Request/Response Smuggling
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- Record
GHSA-3gv6-g396-9v4r- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-04
NVD
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- Record
CVE-2026-28367- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-28367
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- Record
DEBIAN-CVE-2026-28367- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-05
OSVGHSA-3gv6-g396-9v4r
Undertow is Vulnerable to HTTP Request/Response Smuggling
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- Record
GHSA-3gv6-g396-9v4r- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-04
OSVRHSA-2026:25125
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update
- Record
RHSA-2026:25125- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-28367
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
- Record
UBUNTU-CVE-2026-28367- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
- redhat undertow
- redhat build of apache camel - hawtio
- redhat build of apache camel for spring boot
- redhat data grid
- redhat fuse
- redhat jboss enterprise application platform
- redhat jboss enterprise application platform expansion pack
- redhat process automation
- redhat single sign-on
- red hat build of apache camel - hawtio 4
- red hat build of apache camel for spring boot 4
- red hat data grid 8
Show 12 moreShow less
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat fuse 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform 8.1 for rhel 8
- red hat jboss enterprise application platform 8.1 for rhel 9
- red hat jboss enterprise application platform 8.1.6
- red hat jboss enterprise application platform expansion pack
- red hat process automation 7
- red hat single sign-on 7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.undertow:undertow-coreMaven |
2.3.0.Final up to 2.3.25.Final | 2.3.25.Final |
io.undertow:undertow-coreMaven |
before 2.2.40.Final | 2.2.40.Final |
undertowDebian:14 |
All versions, plus listed versions 1.3.11-11.3.16-11.3.19-11.3.21-11.3.23-1 Show 45 moreShow less1.3.4-11.3.5-11.3.7-11.4.0-11.4.1-11.4.18-11.4.20-11.4.21-11.4.21-21.4.22-11.4.23-11.4.23-21.4.23-31.4.25-11.4.25-21.4.3-11.4.4-11.4.6-11.4.7-11.4.8-12.0.23-12.0.25-12.0.26-12.0.27-12.0.28-12.0.29-12.0.30-12.1.0-12.1.1-12.1.3-12.2.0-12.2.10-12.2.12-12.2.13-12.2.14-12.2.16-12.2.17-12.2.18-12.2.19-12.2.2-12.2.20-12.2.21-12.2.3-12.2.4-12.2.5-1 |
None known |
io.undertow:undertow-coreMaven |
2.3.0.Final up to 2.3.25.Final, plus listed versions 2.3.1.Final2.3.10.Final2.3.11.Final2.3.12.Final2.3.13.Final Show 19 moreShow less2.3.14.Final2.3.15.Final2.3.16.Final2.3.17.Final2.3.18.Final2.3.19.Final2.3.2.Final2.3.20.Final2.3.21.Final2.3.22.Final2.3.23.Final2.3.24.Final2.3.3.Final2.3.4.Final2.3.5.Final2.3.6.Final2.3.7.Final2.3.8.Final2.3.9.Final |
2.3.25.Final |
io.undertow:undertow-coreMaven |
before 2.2.40.Final, plus listed versions 1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13 Show 45 moreShow less1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha201.0.0.Alpha211.0.0.Alpha221.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta101.0.0.Beta111.0.0.Beta121.0.0.Beta131.0.0.Beta141.0.0.Beta151.0.0.Beta161.0.0.Beta171.0.0.Beta181.0.0.Beta191.0.0.Beta21.0.0.Beta201.0.0.Beta211.0.0.Beta221.0.0.Beta231.0.0.Beta241.0.0.Beta251.0.0.Beta261.0.0.Beta271.0.0.Beta281.0.0.Beta291.0.0.Beta31.0.0.Beta301.0.0.Beta311.0.0.Beta321.0.0.Beta331.0.0.Beta4 |
2.2.40.Final |
eap8-activemq-artemisRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-cliRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-commonsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-core-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-dtoRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
Show 47 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap8-activemq-artemis-hornetq-protocolRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-hqclient-protocolRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-jakarta-clientRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-jakarta-raRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-jakarta-serverRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-jakarta-service-extensionsRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-jdbc-storeRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-journalRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-selectorRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-activemq-artemis-serverRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el8eap | 0:2.40.0-7.redhat_00015.1.el8eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:801.6.1-1.GA_redhat_00001.1.el8eap | 0:801.6.1-1.GA_redhat_00001.1.el8eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:801.6.1-1.GA_redhat_00001.1.el8eap | 0:801.6.1-1.GA_redhat_00001.1.el8eap |
eap8-undertowRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:2.3.24-3.SP2_redhat_00001.1.el8eap | 0:2.3.24-3.SP2_redhat_00001.1.el8eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el8eap | 0:8.1.6-7.GA_redhat_00010.1.el8eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el8eap | 0:8.1.6-7.GA_redhat_00010.1.el8eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el8eap | 0:8.1.6-7.GA_redhat_00010.1.el8eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el8eap | 0:8.1.6-7.GA_redhat_00010.1.el8eap |
eap8-activemq-artemisRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-cliRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-commonsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-core-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-dtoRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-hornetq-protocolRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-hqclient-protocolRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-jakarta-clientRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-jakarta-raRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-jakarta-serverRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-jakarta-service-extensionsRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-jdbc-storeRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-journalRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-selectorRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-activemq-artemis-serverRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.40.0-7.redhat_00015.1.el9eap | 0:2.40.0-7.redhat_00015.1.el9eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:801.6.1-1.GA_redhat_00001.1.el9eap | 0:801.6.1-1.GA_redhat_00001.1.el9eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:801.6.1-1.GA_redhat_00001.1.el9eap | 0:801.6.1-1.GA_redhat_00001.1.el9eap |
eap8-undertowRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:2.3.24-3.SP2_redhat_00001.1.el9eap | 0:2.3.24-3.SP2_redhat_00001.1.el9eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el9eap | 0:8.1.6-7.GA_redhat_00010.1.el9eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el9eap | 0:8.1.6-7.GA_redhat_00010.1.el9eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el9eap | 0:8.1.6-7.GA_redhat_00010.1.el9eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 4 CVEs |
before 0:8.1.6-7.GA_redhat_00010.1.el9eap | 0:8.1.6-7.GA_redhat_00010.1.el9eap |
undertowUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.4-11.3.5-11.3.7-11.3.11-11.3.16-11.3.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4.20-11.4.21-11.4.22-11.4.23-11.4.23-2build11.4.23-31.4.23-3ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.23-12.0.27-12.0.28-12.0.29-12.0.29-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.2.8-12.2.12-12.2.13-12.2.14-12.2.16-12.2.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.8-22.3.8-2ubuntu0.1~esm1 |
None known |
undertowUbuntu:25.10 |
All versions, plus listed versions 2.3.18-12.3.18-2 |
None known |
undertowUbuntu:26.10 |
All versions, plus listed versions 2.3.20-1ubuntu1 |
None known |
undertowUbuntu:26.04:LTS |
All versions, plus listed versions 2.3.18-22.3.20-12.3.20-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD, OSV | |
| affected, facts, references | EUVD, GitHub Advisories, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-28367 is a high vulnerability (CVSS 8.7) in Redhat Undertow, published March 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in io.undertow:undertow-core 2.3.25.Final.
References
access.redhat.com/errata/RHSA-2026:25125
bugzilla.redhat.com/show_bug.cgi?id=2443260
nvd.nist.gov/vuln/detail/CVE-2026-28367
github.com/undertow-io/undertow/commit/3ece0bf2b2cf5e01db8ca25e41b831e66d3f5961
Show 25 moreShow less
security-tracker.debian.org/tracker/CVE-2026-28367
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25125.json
cve.org/CVERecord?id=CVE-2026-1605
ubuntu.com/security/CVE-2026-28367
This page doesn't list everything
Left out here: 264 versions. The JSON record has them.