CVE-2026-28368
criticalA flaw was found in Undertow.
Vendor / product: Redhat — build of apache camel - hawtio
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-03-27 17:16
Modified: 2026-10-26 21:10
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
redhat / build_of_apache_camel_-_hawtio 4.0
redhat / build_of_apache_camel_for_spring_boot 4.0
redhat / data_grid 8.0
redhat / fuse 7.0.0
redhat / jboss_enterprise_application_platform 7.0.0, 8.0.0
redhat / jboss_enterprise_application_platform_expansion_pack all versions
redhat / process_automation 7.0
redhat / single_sign-on 7.0
redhat / undertow all versions
redhat / enterprise_linux 9.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://access.redhat.com/security/cve/CVE-2026-28368
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2443261
References
- https://access.redhat.com/errata/RHSA-2026:25125 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:25126 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2026-28368 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2443261 secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗