CVE-2026-28369 is an HTTP request smuggling flaw in Undertow. When the first header line starts with spaces, Undertow strips them, which violates HTTP standards and can be abused to smuggle requests. NVD scores it 8.7. Red Hat fixed it in the JBoss EAP 8.1.6 security update.
What's affected
The NVD record lists these Red Hat products: Build of Apache Camel (Hawtio), Build of Apache Camel for Spring Boot, Data Grid, Red Hat Enterprise Linux, Fuse, JBoss Enterprise Application Platform, JBoss EAP Expansion Pack and Process Automation.
Red Hat shipped fixes for JBoss Enterprise Application Platform 8.1 in RHSA-2026:25125 and RHSA-2026:25126, both titled as the JBoss EAP 8.1.6 security update, rated Important. They list the three Undertow CVEs together: CVE-2026-28367, CVE-2026-28368 and CVE-2026-28369. For other Red Hat products, use the CVE page to find the matching errata.
On the Red Hat CVE page, some product and version combinations may be marked with a status such as will not fix. Red Hat's guidance for that status is to upgrade to a supported version that includes the fix, or apply a mitigation if one exists. The weakness is CWE-444 (Inconsistent Interpretation of HTTP Requests).
How to check if you're exposed
Undertow is the web server inside JBoss EAP and WildFly, and it is also embedded in many Java applications. Find it in two places.
For Red Hat JBoss EAP, check the installed version against the errata. The fix is in the 8.1.6 security update.
For Java applications that bundle Undertow, check the dependency tree.
mvn dependency:tree -Dincludes=io.undertow:undertow-core
Gradle users can run gradle dependencies and search the output for undertow-core.
Then look at what sits in front of Undertow. These flaws depend on a proxy or load balancer that interprets the request differently, so list every proxy hop between the internet and your Java servers.
What to do now
- Apply the JBoss EAP 8.1.6 security update or your product's matching update.
- Where Red Hat shows a product as will not fix, plan an upgrade to a supported version that carries the fix.
- Update Undertow in applications that bundle it directly.
- Check that proxies in front of your Java servers reject malformed header lines instead of forwarding them.
- Keep a record of which services run which Undertow version.
Why it matters
The HTTP standard does not allow a request's first header line to begin with whitespace, because whitespace at the start of a line historically meant a continuation of the previous header. Undertow, according to Red Hat, accepted such a line and stripped the spaces, treating it as a normal header.
A proxy in front may treat that same line differently, for example by rejecting it or by reading it as something else. When the proxy and the backend disagree about what a message contains, an attacker has room to send content that the proxy never validated.
The consequences Red Hat lists are bypassing security mechanisms, accessing restricted information and manipulating web caches, which may lead to unauthorized actions or data exposure. These flaws are low glamour but steady in practice. Parsers that are strict about the standard leave fewer gaps than parsers that try to be forgiving.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
What does it mean that Undertow strips the spaces?
It reads a line the standard forbids as if it were valid, which means it can interpret a request differently from a proxy that does not.
Which products does Red Hat list?
Camel (Hawtio and Spring Boot builds), Data Grid, RHEL, Fuse, JBoss EAP, the EAP Expansion Pack and Process Automation, per the NVD record. Check the CVE page for each product's status.
Sources
- Red Hat errata RHSA-2026:25125 (JBoss EAP 8.1.6)
- Red Hat errata RHSA-2026:25126 (JBoss EAP 8.1.6)
- Red Hat CVE page for CVE-2026-28369
Last reviewed: 19 October 2026.
