HIGH 8.7 Maven
Undertow is Vulnerable to HTTP Request/Response Smuggling
GHSA-8v4x-mgvp-p658 · CVE-2026-28368
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28368
- WEB https://github.com/undertow-io/undertow/commit/3ece0bf2b2cf5e01db8ca25e41b831e66d3f5961
- WEB https://github.com/undertow-io/undertow/commit/904e26f1be62fb00b440538608a9574839821878
- WEB https://github.com/undertow-io/undertow/commit/c5dc41479e9c3576552d7e98e31bb1c237ae155e
- WEB https://access.redhat.com/errata/RHSA-2026:25125
- WEB https://access.redhat.com/errata/RHSA-2026:25126
- WEB https://access.redhat.com/security/cve/CVE-2026-28368
- WEB https://bugzilla.redhat.com/show_bug.cgi?id=2443261
- PACKAGE https://github.com/undertow-io/undertow
Ready to move
Start Securing
Free, no credit card | First findings in minutes