---
id: "CVE-2026-28367"
kind: "vulnerability"
aliases: ["CVE-2026-28367", "GHSA-3gv6-g396-9v4r"]
title: "Undertow is Vulnerable to HTTP Request/Response Smuggling"
severity: "critical"
cvss: 9.1
epss: 0.00719
exploited: false
status: "open"
category: "package"
products: [{"name": "io.undertow:undertow-core", "fixed": ["2.3.25.Final"], "affected": ">= 2.3.0.Final, < 2.3.25.Final", "ecosystem": "maven"}, {"name": "io.undertow:undertow-core", "fixed": ["2.2.40.Final"], "affected": "< 2.2.40.Final", "ecosystem": "maven"}, {"name": "redhat build of apache camel - hawtio", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "redhat build of apache camel for spring boot", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "redhat data grid", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat fuse", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "redhat jboss enterprise application platform", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "redhat jboss enterprise application platform", "fixed": [], "affected": "= 8.0.0", "ecosystem": "vendor"}, {"name": "redhat jboss enterprise application platform expansion pack", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "redhat process automation", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat single sign-on", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat undertow", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-444", "java", "jboss", "maven", "package", "undertow", "wildfly"]
not_affected_if: ["no-undertow-dependency", "not-behind-proxy"]
published_at: "2026-03-27T17:16:27+00:00"
first_seen_at: "2026-11-04T21:17:12+00:00"
updated_at: "2026-11-04T21:49:23+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-3gv6-g396-9v4r", "first_seen_at": "2026-11-04T21:17:12+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28367", "first_seen_at": "2026-11-04T21:49:23+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00719, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28367"}]
---

# Undertow is Vulnerable to HTTP Request/Response Smuggling

Undertow, a Java web server library, accepts `\r\r\r` as a header block terminator, so a remote attacker can smuggle requests past certain proxies. The result can be unauthorized access to or manipulation of web requests handled behind those proxies.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:io.undertow:undertow-core affected >= 2.3.0.Final, < 2.3.25.Final fixed 2.3.25.Final
- maven:io.undertow:undertow-core affected < 2.2.40.Final fixed 2.2.40.Final
- vendor:redhat build of apache camel - hawtio affected = 4.0 fixed ?
- vendor:redhat build of apache camel for spring boot affected = 4.0 fixed ?
- vendor:redhat data grid affected = 8.0 fixed ?
- vendor:redhat fuse affected = 7.0.0 fixed ?
- vendor:redhat jboss enterprise application platform affected = 7.0.0 fixed ?
- vendor:redhat jboss enterprise application platform affected = 8.0.0 fixed ?
- vendor:redhat jboss enterprise application platform expansion pack affected ? fixed ?
- vendor:redhat process automation affected = 7.0 fixed ?
- vendor:redhat single sign-on affected = 7.0 fixed ?
- vendor:redhat undertow affected ? fixed ?

## How to check

- Check the `io.undertow:undertow-core` version in your Maven or Gradle dependency tree, for example with `mvn dependency:tree | grep undertow-core`.
- Look for Undertow behind a reverse proxy or load balancer such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer.

## Fix

- `io.undertow:undertow-core` `2.3.25.Final` for the 2.3.x line
- `io.undertow:undertow-core` `2.2.40.Final` for the 2.2.x line

## Timeline

- 2026-11-04T21:17:12+00:00 ghsa https://github.com/advisories/GHSA-3gv6-g396-9v4r
- 2026-11-04T21:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28367

## Documents

- [advisory] Vendor advisory: access.redhat.com https://access.redhat.com/security/cve/CVE-2026-28367
- [advisory] Vendor advisory: bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2443260
- [fix] Patch: github.com https://github.com/undertow-io/undertow/commit/3ece0bf2b2cf5e01db8ca25e41b831e66d3f5961
- [fix] Patch: github.com https://github.com/undertow-io/undertow/commit/904e26f1be62fb00b440538608a9574839821878
- [fix] Patch: github.com https://github.com/undertow-io/undertow/commit/c5dc41479e9c3576552d7e98e31bb1c237ae155e

## From the sources

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_