IO.UNDERTOW:UNDERTOW-CORE · CVE-2026-28367 · Package
FIX → 2.3.25.Final · 2.2.40.Final
Undertow, a Java web server library, accepts `\r\r\r` as a header block terminator, so a remote attacker can smuggle requests past certain proxies. The result can be unauthorized access to or manipulation of web requests handled behind those proxies.
first public Mar 27, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed Undertow as their HTTP server, especially those placed behind a proxy that parses header terminators differently. Standalone Undertow deployments without an upstream proxy are less exposed, but the sources do not say how much that reduces risk. Teams using a different server, or Undertow only as a test fixture, can skip it.
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Not affected if no-undertow-dependency, not-behind-proxy
Who cares cwe-444, java, jboss, maven, undertow, wildfly
io.undertow:undertow-core version in your Maven or Gradle dependency tree, for example with mvn dependency:tree | grep undertow-core.Upgrade to 2.3.25.Final · 2.2.40.Final
io.undertow:undertow-core 2.3.25.Final for the 2.3.x lineio.undertow:undertow-core 2.2.40.Final for the 2.2.x lineGitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.