CVE-2026-28368 - Vulnerability Analysis

Overview

Undertow contains an HTTP request smuggling vulnerability caused by inconsistent header name parsing compared to upstream proxies, letting remote attackers bypass security controls and access unauthorized resources, exploit requires crafted requests.

Severity & Score

Impact

Remote attackers can bypass security controls and access unauthorized resources via request smuggling.

Mitigation

Update to the latest version of Undertow.

References

• https://access.redhat.com/security/cve/CVE-2026-28368
• https://bugzilla.redhat.com/show_bug.cgi?id=2443261

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 27, 2026

🟠 CVE-2026-28368 - High (8.7) A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28368/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner