CVE-2026-28368 - Vulnerability Analysis

Overview

Undertow contains an HTTP request smuggling vulnerability caused by inconsistent header name parsing compared to upstream proxies, letting remote attackers bypass security controls and access unauthorized resources, exploit requires crafted requests.

Severity & Score

Impact

Remote attackers can bypass security controls and access unauthorized resources via request smuggling.

Mitigation

Update to the latest version of Undertow.

References

• https://access.redhat.com/security/cve/CVE-2026-28368
• https://bugzilla.redhat.com/show_bug.cgi?id=2443261

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner