RHSA-2026:25126

Vulnerability from csaf_redhat - Published: 2026-06-10 20:25 - Updated: 2026-06-11 03:04
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update
Severity
Important
Notes
Topic: A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests important (CVE-2026-1605) * undertow-core: Undertow: Request Smuggling via Malformed HTTP Request Headers (CVE-2026-28369) * undertow-core: Undertow: Request smuggling via inconsistent header parsing (CVE-2026-28368) * undertow-core: Undertow: Request smuggling via `\r\r\r` as a header block terminator (CVE-2026-28367) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-1605

A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-28367

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-28368

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-28369

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:25126 self
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://access.redhat.com/articles/7129481 external
https://bugzilla.redhat.com/show_bug.cgi?id=2443260 external
https://bugzilla.redhat.com/show_bug.cgi?id=2443261 external
https://bugzilla.redhat.com/show_bug.cgi?id=2443262 external
https://bugzilla.redhat.com/show_bug.cgi?id=2444815 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-1605 self
https://bugzilla.redhat.com/show_bug.cgi?id=2444815 external
https://www.cve.org/CVERecord?id=CVE-2026-1605 external
https://nvd.nist.gov/vuln/detail/CVE-2026-1605 external
https://github.com/jetty/jetty.project/security/a… external
https://access.redhat.com/security/cve/CVE-2026-28367 self
https://bugzilla.redhat.com/show_bug.cgi?id=2443260 external
https://www.cve.org/CVERecord?id=CVE-2026-28367 external
https://nvd.nist.gov/vuln/detail/CVE-2026-28367 external
https://access.redhat.com/security/cve/CVE-2026-28368 self
https://bugzilla.redhat.com/show_bug.cgi?id=2443261 external
https://www.cve.org/CVERecord?id=CVE-2026-28368 external
https://nvd.nist.gov/vuln/detail/CVE-2026-28368 external
https://access.redhat.com/security/cve/CVE-2026-28369 self
https://bugzilla.redhat.com/show_bug.cgi?id=2443262 external
https://www.cve.org/CVERecord?id=CVE-2026-28369 external
https://nvd.nist.gov/vuln/detail/CVE-2026-28369 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime.\n\nThis asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n*  jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests important (CVE-2026-1605)\n\n* undertow-core: Undertow: Request Smuggling via Malformed HTTP Request Headers (CVE-2026-28369)\n\n* undertow-core: Undertow: Request smuggling via inconsistent header parsing (CVE-2026-28368)\n\n* undertow-core: Undertow: Request smuggling via `\\r\\r\\r` as a header block terminator (CVE-2026-28367)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:25126",
        "url": "https://access.redhat.com/errata/RHSA-2026:25126"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/7129481",
        "url": "https://access.redhat.com/articles/7129481"
      },
      {
        "category": "external",
        "summary": "2443260",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443260"
      },
      {
        "category": "external",
        "summary": "2443261",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443261"
      },
      {
        "category": "external",
        "summary": "2443262",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443262"
      },
      {
        "category": "external",
        "summary": "2444815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25126.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update",
    "tracking": {
      "current_release_date": "2026-06-11T03:04:49+00:00",
      "generator": {
        "date": "2026-06-11T03:04:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.2"
        }
      },
      "id": "RHSA-2026:25126",
      "initial_release_date": "2026-06-10T20:25:03+00:00",
      "revision_history": [
        {
          "date": "2026-06-10T20:25:03+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-10T20:25:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-11T03:04:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 8.1",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 8.1",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 8.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1605",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-03-05T11:00:57.250283+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2444815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1605"
        },
        {
          "category": "external",
          "summary": "RHBZ#2444815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
        },
        {
          "category": "external",
          "summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
          "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
        }
      ],
      "release_date": "2026-03-05T09:39:01.315000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T20:25:03+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
    },
    {
      "cve": "CVE-2026-28367",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-02-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443260"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\\r\\r\\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Undertow: Request smuggling via `\\r\\r\\r` as a header block terminator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Undertow web server is susceptible to request smuggling when deployed with certain proxy servers that forward `\\r\\r\\r` as a header block terminator. This flaw could enable an attacker to manipulate web requests, potentially leading to unauthorized access. Red Hat products using Undertow in environments with vulnerable proxy configurations, such as those found in older versions of Apache Traffic Server or Google Cloud Classic Application Load Balancer, are at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28367"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443260",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443260"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28367",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28367"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28367",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28367"
        }
      ],
      "release_date": "2025-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T20:25:03+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25126"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, configure any proxy servers positioned in front of Undertow to strictly validate HTTP header terminations. Ensure that these proxies are configured to reject or normalize non-standard header block terminators, such as `\\r\\r\\r`, before forwarding requests to Undertow. This operational control helps prevent request smuggling attacks by ensuring that only properly formed HTTP requests reach the Undertow server.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow: Undertow: Request smuggling via `\\r\\r\\r` as a header block terminator"
    },
    {
      "cve": "CVE-2026-28368",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-02-27T04:39:57.578000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443261"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Undertow: Request smuggling via inconsistent header parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in Undertow\u0027s header parsing logic allows for request smuggling attacks when Undertow is deployed behind an upstream proxy. Crafted requests can bypass security controls by being interpreted differently by Undertow and the proxy, potentially leading to unauthorized access or cache poisoning.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28368"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443261",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443261"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28368",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28368"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28368",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28368"
        }
      ],
      "release_date": "2025-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T20:25:03+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25126"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow: Undertow: Request smuggling via inconsistent header parsing"
    },
    {
      "cve": "CVE-2026-28369",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-02-27T04:39:59.064000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443262"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Undertow: Request Smuggling via Malformed HTTP Request Headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28369"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443262",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443262"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28369",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28369"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28369",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28369"
        }
      ],
      "release_date": "2025-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-10T20:25:03+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:25126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow: Undertow: Request Smuggling via Malformed HTTP Request Headers"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.