Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
7 versions affected across 10 products
| Date | Total | Labels |
|---|
| 2026-03-27 | 2 | Disclosure1General1 |
| 2026-03-28 | 1 | General1 |
CVE-2026-28368 A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Underto… https://www.cve.org/CVERecord?id=CVE-2026-28368
Post summary
The message notes a flaw in Undertow that lets remote attackers craft requests with header names parsed differently, but provides no further details on exploitation, patching, or PoC.
🟠 CVE-2026-28368 - High A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream pr... https://www.thehackerwire.com/vulnerability/CVE-2026-28368/ https://t.co/d65izVCQen
Post summary
The tweet announces a high‑severity CVE‑2026‑28368 in Undertow, noting that attackers can craft special header requests that exploit a parsing difference; however, it provides no exploitation, patch, or active use details.
[CVE-2026-28368: HIGH] Security flaw in Undertow allows remote attacks through specially crafted requests, exploiting header interpretation differences for potential request smuggling and bypassing security ...#cve,CVE-2026-28368,#cybersecurity https://cvefind.com/CVE-2026-28368
Post summary
The post announces a high-severity vulnerability (CVE-2026-28368) in Undertow, detailing potential request smuggling via crafted headers, but does not provide PoC, exploit code, or patch information.
11 of 11 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | build_of_apache_camel_-_hawtio | 4.0 | - | - |
| App | redhat | build_of_apache_camel_for_spring_boot | 4.0 | - | - |
| App | redhat | data_grid | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |
| App | redhat | fuse | 7.0.0 | - | - |
| App | redhat | jboss_enterprise_application_platform | 7.0.0 | - | - |
| App | redhat | jboss_enterprise_application_platform | 8.0.0 | - | - |
| App | redhat | jboss_enterprise_application_platform_expansion_pack | - | - | - |
| App | redhat | process_automation | 7.0 | - | - |
| App | redhat | single_sign-on | 7.0 | - | - |
| App | redhat | undertow | - | - | - |