CVE-2026-28367
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.7EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
27 mar 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Productos afectados
Red Hat · Red Hat build of Apache Camel for Spring Boot 4Red Hat · Red Hat build of Apache Camel - HawtIO 4Red Hat · Red Hat Data Grid 8Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Fuse 7Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform 8.1Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8Red Hat · Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Process Automation 7Red Hat · Red Hat Single Sign-On 7¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →