Undertow CVE-2026-28367

Exploitation requires (1) the Undertow back-end to be reachable through a specific class of upstream proxy that accepts \r\r\r as a header-block terminator - explicitly older versions of Apache Traffic Server or Google Cloud Classic Application Load Balancer - and (2) the attacker to be able to send raw HTTP/1.1 requests through that proxy to the Undertow origin. Limiting factors: deployments without a vulnerable fronting proxy (e.g., Undertow exposed directly, or behind modern nginx/HAProxy/AWS ALB/Cloudflare that reject the malformed terminator) cannot be smuggled via this primitive; the CVSS vector confirms no authentication and no user interaction are required against a qualifying deployment.

Signals diverge sharply. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H, A:N) and SSVC technical impact 'total' suggest a severe, network-reachable, unauthenticated flaw. However, EPSS is 0.04% (11th percentile), SSVC marks exploitation as 'none' and 'not automatable', it is absent from CISA KEV, and no public exploit identified at time of analysis. Practical exploitability is also bounded: exploitation requires Undertow to sit behind one of the specific vulnerable proxies (older Apache Traffic Server, GCP Classic ALB) that mis-parse \r\r\r, so deployments fronted by other proxies (modern nginx/HAProxy/AWS ALB/Cloudflare with strict parsing) are likely unaffected in practice. Net: a high-impact issue worth patching during the next maintenance window, but not a drop-everything incident for most operators; prioritize hosts known to sit behind the named vulnerable intermediaries.

An attacker reachable through the front-end proxy sends an HTTP request whose headers end with \r\r\r, followed by a smuggled second request piggy-backed in the body. The vulnerable proxy forwards what it considers one request, but Undertow splits it into two - the smuggled request is then attributed to the next legitimate user's connection, enabling session hijack, cache poisoning, or bypass of front-end auth/WAF rules. No public exploit identified at time of analysis, but the technique is well-documented in HTTP request smuggling literature and trivially scriptable once a vulnerable proxy chain is identified.