CVE-2026-28368

Опубликовано: 27 мар. 2026

Источник: nvd

CVSS3: 8.7

CVSS3: 9.1

EPSS Низкий

Описание

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

Ссылки

https://access.redhat.com/errata/RHSA-2026:25125
https://access.redhat.com/errata/RHSA-2026:25126
https://access.redhat.com/security/cve/CVE-2026-28368
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2443261
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00704

Низкий

8.7 High

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-444

Связанные уязвимости

CVE-2026-28368

CVSS3: 8.7

ubuntu

5 месяцев назад

CVE-2026-28368

CVSS3: 8.7

redhat

12 месяцев назад

CVE-2026-28368

CVSS3: 8.7

debian

5 месяцев назад

A flaw was found in Undertow. This vulnerability allows a remote attac ...

GHSA-8v4x-mgvp-p658

CVSS3: 8.7

github

5 месяцев назад

Undertow is Vulnerable to HTTP Request/Response Smuggling

EPSS

Процентиль: 50%

0.00704

Низкий

8.7 High

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-444