CVE-2026-28367Disclosure(redhat / build_of_apache_camel_-_hawtio)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

redhat CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-444

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

build_of_apache_camel_-_hawtio
build_of_apache_camel_for_spring_boot
data_grid
fuse

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-27); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

redhat

Products

build_of_apache_camel_-_hawtiobuild_of_apache_camel_for_spring_bootdata_gridfusejboss_enterprise_application_platformjboss_enterprise_application_platform_expansion_packprocess_automationsingle_sign-onundertow

6 versions affected across 9 products

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-27	2	Disclosure2
2026-03-28	1	Disclosure1

Full discourse3 posts

CVE@CVEnew195d
Disclosure
CVE-2026-28367 A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smugglin… https://www.cve.org/CVERecord?id=CVE-2026-28367
Post summary
The message discloses a new Undertow vulnerability (CVE‑2026‑28367) that allows request smuggling via a malicious header terminator sequence, but it provides no PoC, exploit code, or evidence of active exploitation.
0000095
56.9K followersView on X
The Hacker Wire@TheHackerWire196d
Disclosure
🟠 CVE-2026-28367 - High A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy serv... https://www.thehackerwire.com/vulnerability/CVE-2026-28367/ https://t.co/TQqLITrkFO
Post summary
The post discloses a high‑severity request smuggling flaw in Undertow, noting how an attacker can send `\r\r\r` as a header block terminator, but it provides no PoC, exploit code, patch, or evidence of active use.
0000052
163 followersView on X
CVEFind.com@CveFindCom196d
Disclosure
[CVE-2026-28367: HIGH] Critical flaw in Undertow: Sending `\r\r\r` can lead to request smuggling in certain proxy servers like Apache Traffic Server and Google Cloud Classic ALB, posing serious security risks.#cve,CVE-2026-28367,#cybersecurity https://cvefind.com/CVE-2026-28367
Post summary
A new high‑severity vulnerability (CVE‑2026‑28367) in Undertow can cause request smuggling when attackers send '\r\r\r' to proxy servers like Apache Traffic Server and Google Cloud Classic ALB, potentially exposing significant security risks.
00000245
617 followersView on X

CPE platform detail10 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

10 of 10 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	redhat	build_of_apache_camel_-_hawtio	4.0	-	-
App	redhat	build_of_apache_camel_for_spring_boot	4.0	-	-
App	redhat	data_grid	8.0	-	-
App	redhat	fuse	7.0.0	-	-
App	redhat	jboss_enterprise_application_platform	7.0.0	-	-
App	redhat	jboss_enterprise_application_platform	8.0.0	-	-
App	redhat	jboss_enterprise_application_platform_expansion_pack	-	-	-
App	redhat	process_automation	7.0	-	-
App	redhat	single_sign-on	7.0	-	-
App	redhat	undertow	-	-	-

Explore more

Back to dashboard redhat CVEs build_of_apache_camel_-_hawtio vulnerabilities

What researchers are saying

CVE-2026-28367

CVE@CVEnewDisclosure

The message discloses a new Undertow vulnerability (CVE‑2026‑28367) that allows request smuggling via a malicious header terminator sequence, but it provides no PoC, exploit code, or evidence of active exploitation.

The Hacker Wire@TheHackerWireDisclosure

The post discloses a high‑severity request smuggling flaw in Undertow, noting how an attacker can send `\r\r\r` as a header block terminator, but it provides no PoC, exploit code, patch, or evidence of active use.

CVEFind.com@CveFindComDisclosure

A new high‑severity vulnerability (CVE‑2026‑28367) in Undertow can cause request smuggling when attackers send '\r\r\r' to proxy servers like Apache Traffic Server and Google Cloud Classic ALB, potentially exposing significant security risks.