CVE-2026-28367

Опубликовано: 27 мар. 2026

Источник: nvd

CVSS3: 8.7

CVSS3: 9.1

EPSS Низкий

Описание

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

Ссылки

https://access.redhat.com/errata/RHSA-2026:25125
https://access.redhat.com/errata/RHSA-2026:25126
https://access.redhat.com/security/cve/CVE-2026-28367
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2443260
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00706

Низкий

8.7 High

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-444

Связанные уязвимости

CVE-2026-28367

CVSS3: 8.7

ubuntu

5 месяцев назад

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

CVE-2026-28367

CVSS3: 8.7

redhat

12 месяцев назад

CVE-2026-28367

CVSS3: 8.7

debian

5 месяцев назад

A flaw was found in Undertow. A remote attacker can exploit this vulne ...

GHSA-3gv6-g396-9v4r

CVSS3: 8.7

github

5 месяцев назад

Undertow is Vulnerable to HTTP Request/Response Smuggling

EPSS

Процентиль: 50%

0.00706

Низкий

8.7 High

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-444