Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p645-xsq3-pfc2
Vulnerability ID VCID-p645-xsq3-pfc2
Aliases CVE-2026-28369
GHSA-vqqj-9cmv-hx43
Summary Undertow is Vulnerable to HTTP Request/Response Smuggling A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28369.json
cvssv3.1 8.7 https://access.redhat.com/security/cve/CVE-2026-28369
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2026-28369
ssvc Track https://access.redhat.com/security/cve/CVE-2026-28369
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2026-28369
cvssv3.1 8.7 https://bugzilla.redhat.com/show_bug.cgi?id=2443262
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=2443262
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2443262
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-vqqj-9cmv-hx43
cvssv3.1 8.7 https://github.com/undertow-io/undertow
generic_textual HIGH https://github.com/undertow-io/undertow
cvssv3.1 8.7 https://nvd.nist.gov/vuln/detail/CVE-2026-28369
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-28369
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28369.json
https://access.redhat.com/security/cve/CVE-2026-28369
https://api.first.org/data/v1/epss?cve=CVE-2026-28369
https://bugzilla.redhat.com/show_bug.cgi?id=2443262
https://github.com/undertow-io/undertow
https://nvd.nist.gov/vuln/detail/CVE-2026-28369
1134952 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134952
cpe:/a:redhat:apache_camel_hawtio:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:apache_camel_hawtio:4
cpe:/a:redhat:camel_spring_boot:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:jboss_data_grid:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jbosseapxp https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:jboss_enterprise_application_platform:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jboss_enterprise_bpms_platform:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_bpms_platform:7
cpe:/a:redhat:jboss_fuse:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:red_hat_single_sign_on:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/o:redhat:enterprise_linux:10 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
GHSA-vqqj-9cmv-hx43 https://github.com/advisories/GHSA-vqqj-9cmv-hx43
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28369.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2026-28369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-28T03:55:51Z/ Found at https://access.redhat.com/security/cve/CVE-2026-28369
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2443262
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-28T03:55:51Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2443262
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://github.com/undertow-io/undertow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-28369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.12549
EPSS Score 0.00041
Published At April 21, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:54:01.310703+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vqqj-9cmv-hx43/GHSA-vqqj-9cmv-hx43.json 38.0.0