CVE-2026-28368: 
Java vulnerability analysis and mitigation

CVE-2026-28368 is an HTTP request smuggling vulnerability in Red Hat Undertow, a Java-based web server and servlet container. The flaw arises because Undertow splits HTTP header names from values on either a space or colon — whichever comes first — causing header names to be parsed differently than upstream proxies interpret them. This discrepancy allows remote attackers to craft requests that are invisible to upstream proxies but visible to Undertow, enabling request smuggling attacks that can bypass security controls and access unauthorized resources. Affected products include Red Hat JBoss Enterprise Application Platform (7.0.0, 8.0.0), Red Hat Fuse (7.0.0), Red Hat Process Automation (7.0), Red Hat Single Sign-On (7.0), Red Hat Data Grid (8.0), Red Hat Enterprise Linux (9.0), and builds of Apache Camel for Spring Boot and Camel Hawtio (4.0). The vulnerability was reported on 2026-02-27 and published on 2026-03-27, with patches released on 2026-06-10. It carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). Undertow's header parsing logic treats either a space or a colon as a delimiter between a header name and its value, whichever appears first in the raw request. This non-standard behavior means an attacker can craft a header such as X-Custom Header: value (with a space before the colon), which Undertow interprets as a header named X-Custom while an upstream proxy sees it differently — or vice versa. By exploiting this parsing discrepancy, an attacker can smuggle HTTP requests past security controls enforced by the proxy layer, causing the backend (Undertow) to process requests that the proxy believes it has already handled or rejected. No authentication or user interaction is required, and the attack is conducted entirely over the network (Red Hat Bugzilla, The Hacker Wire).

Successful exploitation can result in bypassing security controls enforced by upstream proxies, unauthorized access to protected backend resources, cache poisoning, session hijacking, and credential theft. The vulnerability has a high impact on both confidentiality and integrity, with no direct availability impact. In environments where Undertow sits behind a reverse proxy or load balancer (a common deployment pattern for JBoss EAP, Red Hat SSO, and similar products), an attacker could leverage smuggled requests to access administrative endpoints, poison shared caches, or hijack authenticated user sessions — potentially enabling lateral movement within the application infrastructure (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify deployments of Red Hat Undertow-based products (JBoss EAP, Red Hat SSO, Data Grid, etc.) sitting behind a reverse proxy or load balancer using network scanning or application fingerprinting tools.
2. Craft a malicious HTTP request: Construct an HTTP request containing a header with a space before the colon in the header name (e.g., X-Forwarded-For : 127.0.0.1 or a custom header like Transfer-Encoding : chunked). Undertow will parse this differently than the upstream proxy.
3. Smuggle a secondary request: Embed a second, hidden HTTP request within the body or headers of the crafted request, exploiting the parsing discrepancy so the upstream proxy sees one request while Undertow processes two.
4. Bypass security controls: The smuggled request may bypass IP allowlists, authentication checks, or WAF rules enforced at the proxy layer, reaching protected backend endpoints.
5. Achieve objective: Depending on the target environment, the attacker may access administrative APIs, poison shared HTTP caches to serve malicious responses to other users, or hijack authenticated sessions by prepending content to a victim's next request (Red Hat Bugzilla, The Hacker Wire).

• Network: Unusual HTTP requests with malformed or ambiguous header names (e.g., headers containing spaces before the colon delimiter) arriving at Undertow-based services; unexpected sequences of requests from a single connection that do not match the upstream proxy's forwarded request log.
• Logs: Discrepancies between the upstream proxy's access logs and Undertow's access logs for the same time window (e.g., Undertow processing more requests than the proxy recorded forwarding); unexpected access to protected or administrative endpoints from IP addresses that should be blocked by proxy-layer ACLs.
• Application Behavior: Cache poisoning symptoms such as users receiving responses intended for other users; unexpected session invalidation or session fixation events in application logs; authentication bypass events where protected resources are accessed without valid credentials in Undertow's security audit logs.

Red Hat has released patches addressing this vulnerability via two security errata for Red Hat JBoss Enterprise Application Platform 8.1: RHSA-2026:25126 (for standalone EAP 8.1) and RHSA-2026:25125 (for EAP 8.1 on RHEL 8 and RHEL 9), both published on 2026-06-10 (Red Hat Bugzilla, Red Hat Errata). Organizations should prioritize patching all affected Red Hat products including JBoss EAP (7.0.0, 8.0.0), Red Hat Fuse (7.0.0), Red Hat Process Automation (7.0), Red Hat Single Sign-On (7.0), Red Hat Data Grid (8.0), and Apache Camel builds (4.0). As a temporary workaround where patching is not immediately possible, consider enforcing strict HTTP header validation at the upstream proxy or WAF layer to reject requests with non-standard header name formatting (e.g., headers containing spaces before the colon). Monitor Red Hat's security advisory page for additional errata covering other affected product lines (Red Hat CVE).

The vulnerability received coverage from The Hacker Wire, which published a technical article on the header interpretation discrepancy in Undertow shortly after disclosure (The Hacker Wire). RedPacket Security flagged the CVE across its social media channels and alert feeds, noting the broad impact across Red Hat's product portfolio. Community discussion has been moderate, with security practitioners noting the high CVSS score and the wide range of affected Red Hat enterprise products as key concerns. No major vendor statements beyond Red Hat's own advisories have been issued.