EXPOSURES › CVE-2026-28367
CVE-2026-28367
HIGH
DETAIL
SourceNVD · cve
Published2026-03-27
CVSS8.7
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-28367 ↗
▸ RECOMMENDED ACTION Patch the affected products and confirm your instances are covered.
PLAYERS IMPLICATED
redhat · vendorbuild of apache camel - hawtio · productbuild of apache camel for spring boot · productdata grid · productfuse · productjboss enterprise application platform · productjboss enterprise application platform expansion pack · productprocess automation · productsingle sign-on · productundertow · product
DESCRIPTION
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.