---
id: "CVE-2026-28368"
kind: "vulnerability"
aliases: ["CVE-2026-28368", "GHSA-8v4x-mgvp-p658"]
title: "Undertow is Vulnerable to HTTP Request/Response Smuggling"
severity: "critical"
cvss: 9.1
epss: 0.00732
exploited: false
status: "open"
category: "package"
products: [{"name": "io.undertow:undertow-core", "fixed": ["2.2.40.Final"], "affected": "< 2.2.40.Final", "ecosystem": "maven"}, {"name": "io.undertow:undertow-core", "fixed": ["2.3.25.Final"], "affected": ">= 2.3.0.Final, < 2.3.25.Final", "ecosystem": "maven"}, {"name": "redhat build of apache camel - hawtio", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "redhat build of apache camel for spring boot", "fixed": [], "affected": "= 4.0", "ecosystem": "vendor"}, {"name": "redhat data grid", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat fuse", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "redhat jboss enterprise application platform", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "redhat jboss enterprise application platform", "fixed": [], "affected": "= 8.0.0", "ecosystem": "vendor"}, {"name": "redhat jboss enterprise application platform expansion pack", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "redhat process automation", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat single sign-on", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat undertow", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-444", "java", "jboss", "maven", "package", "undertow", "wildfly"]
not_affected_if: ["no-proxy-in-front", "version-outside-affected-range"]
published_at: "2026-03-27T17:16:27+00:00"
first_seen_at: "2026-11-04T21:24:04+00:00"
updated_at: "2026-11-04T21:49:23+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-8v4x-mgvp-p658", "first_seen_at": "2026-11-04T21:24:04+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28368", "first_seen_at": "2026-11-04T21:49:23+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00732, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28368"}]
---

# Undertow is Vulnerable to HTTP Request/Response Smuggling

Undertow parses some HTTP header names differently from upstream proxies, so a crafted request can be read one way by the proxy and another way by Undertow. An attacker can use this to bypass security controls and reach resources they should not access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:io.undertow:undertow-core affected < 2.2.40.Final fixed 2.2.40.Final
- maven:io.undertow:undertow-core affected >= 2.3.0.Final, < 2.3.25.Final fixed 2.3.25.Final
- vendor:redhat build of apache camel - hawtio affected = 4.0 fixed ?
- vendor:redhat build of apache camel for spring boot affected = 4.0 fixed ?
- vendor:redhat data grid affected = 8.0 fixed ?
- vendor:redhat fuse affected = 7.0.0 fixed ?
- vendor:redhat jboss enterprise application platform affected = 7.0.0 fixed ?
- vendor:redhat jboss enterprise application platform affected = 8.0.0 fixed ?
- vendor:redhat jboss enterprise application platform expansion pack affected ? fixed ?
- vendor:redhat process automation affected = 7.0 fixed ?
- vendor:redhat single sign-on affected = 7.0 fixed ?
- vendor:redhat undertow affected ? fixed ?
- vendor:redhat enterprise linux affected = 9.0 fixed ?

## How to check

- Check the version of `io.undertow:undertow-core` in your Maven dependency tree (for example with `mvn dependency:tree`).
- Confirm whether a reverse proxy or load balancer sits in front of the Undertow application.

## Fix

- `io.undertow:undertow-core` `2.2.40.Final` for the 2.2.x line
- `io.undertow:undertow-core` `2.3.25.Final` for the 2.3.x line

## Timeline

- 2026-11-04T21:24:04+00:00 ghsa https://github.com/advisories/GHSA-8v4x-mgvp-p658
- 2026-11-04T21:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28368

## Documents

- [advisory] Vendor advisory: access.redhat.com https://access.redhat.com/security/cve/CVE-2026-28368
- [advisory] Vendor advisory: bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2443261
- [fix] Patch: github.com https://github.com/undertow-io/undertow/commit/3ece0bf2b2cf5e01db8ca25e41b831e66d3f5961
- [fix] Patch: github.com https://github.com/undertow-io/undertow/commit/904e26f1be62fb00b440538608a9574839821878
- [fix] Patch: github.com https://github.com/undertow-io/undertow/commit/c5dc41479e9c3576552d7e98e31bb1c237ae155e

## From the sources

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_