CVE-2026-28368: Undertow Request Smuggling via Header Parsing

CVE-2026-28368 is an HTTP request smuggling flaw in Undertow, caused by header names being parsed differently from the way upstream proxies parse them. NVD scores it 8.7. Red Hat fixed it in the JBoss EAP 8.1.6 security update, which also covers two sibling Undertow CVEs.

What's affected

Red Hat lists these as affected products in the NVD record: Build of Apache Camel (Hawtio), Build of Apache Camel for Spring Boot, Data Grid, Red Hat Enterprise Linux, Fuse, JBoss Enterprise Application Platform, JBoss EAP Expansion Pack and Process Automation.

Red Hat shipped fixes for JBoss Enterprise Application Platform 8.1 in RHSA-2026:25125 and RHSA-2026:25126, both titled as the JBoss EAP 8.1.6 security update, rated Important. They list the three Undertow CVEs together: CVE-2026-28367, CVE-2026-28368 and CVE-2026-28369. For other Red Hat products, use the CVE page to find the matching errata.

Red Hat's mitigation field says no mitigation is available that meets its criteria for ease of use and wide applicability, so patching is the route. The weakness is CWE-444 (Inconsistent Interpretation of HTTP Requests).

How to check if you're exposed

Undertow is the web server inside JBoss EAP and WildFly, and it is also embedded in many Java applications. Find it in two places.

For Red Hat JBoss EAP, check the installed version against the errata. The fix is in the 8.1.6 security update.

For Java applications that bundle Undertow, check the dependency tree.

mvn dependency:tree -Dincludes=io.undertow:undertow-core

Gradle users can run gradle dependencies and search the output for undertow-core.

Then look at what sits in front of Undertow. These flaws depend on a proxy or load balancer that interprets the request differently, so list every proxy hop between the internet and your Java servers.

What to do now

1. Apply the JBoss EAP 8.1.6 security update, or the Red Hat update that matches your product, and update bundled Undertow in your own applications.
2. Use the Red Hat CVE page to find the right errata for products other than JBoss EAP.
3. Review the proxies in front of your Java servers and keep them current, since the flaw lies in how two parsers read the same bytes.
4. Do not treat a WAF as a substitute for the patch. Smuggled requests are by definition the ones the proxy does not inspect properly.
5. Add the Undertow version to your service inventory.

Why it matters

Headers look simple, but there are many edge cases in how names are read: case, whitespace, unusual characters, and duplicates. Two parsers can handle one of those edge cases differently. If the proxy ignores a header the backend honours, or the other way round, a request can mean one thing to the proxy and another to the backend.

Red Hat's description is that a remote attacker can construct requests where header names are parsed differently by Undertow and by upstream proxies. The outcome is request smuggling, which can bypass security controls and expose resources that should be restricted.

Because Red Hat offers no mitigation for this one, the dependable fix is the patched Undertow. The related CVE-2026-28367 and CVE-2026-28369 ship in the same update, so one maintenance window covers all three.

The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.

Quick check

Sources

• Red Hat errata RHSA-2026:25125 (JBoss EAP 8.1.6)
• Red Hat errata RHSA-2026:25126 (JBoss EAP 8.1.6)
• Red Hat CVE page for CVE-2026-28368

Last reviewed: 19 October 2026.