CoreCVE
Back

CRITICAL

Undertow: undertow: request smuggling via inconsistent header parsing

Published Mar 27, 2026

Description

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Red Hat statement

This flaw in Undertow's header parsing logic allows for request smuggling attacks when Undertow is deployed behind an upstream proxy. Crafted requests can bypass security controls by being interpreted differently by Undertow and the proxy, potentially leading to unauthorized access or cache poisoning.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Metrics

Weaknesses (1)

CWE-444

References (7)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 27, 2026
Updated Sep 21, 2026
Reserved Feb 27, 2026
Link CVE-2026-28368
CISA Vulnrichment
Updated Mar 27, 2026
NVD
Status Modified
Modified Jun 29, 2026
Link CVE-2026-28368
Red Hat
Severity Important
Public date Aug 27, 2025
Links CVE-2026-28368 - Bugzilla
GHSA-8V4X-MGVP-P658