Undertow CVE-2026-28368

Exploitation requires Undertow to be deployed behind an upstream HTTP proxy, load balancer, or CDN that parses header names differently from Undertow - a standalone Undertow with clients connecting directly is not exploitable for smuggling because there is no parsing-discrepancy partner. The attacker needs network reach to the fronting proxy over HTTP/1.1 with connection reuse enabled between proxy and Undertow; HTTP/2-only paths or proxy-to-origin connections that disable keep-alive break the primitive. No authentication or user interaction is required (PR:N/UI:N), and the attack works against default Undertow configurations in the affected JBoss EAP, Data Grid, Fuse, and Camel products as long as a tolerant-vs-strict proxy pair fronts them.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N rates the issue 9.1 Critical, reflecting remote, unauthenticated, low-complexity exploitation with high confidentiality and integrity impact but no availability impact - consistent with request smuggling that leaks or hijacks proxied requests rather than crashing the server. Counter-signals temper urgency: EPSS is only 0.10% (26th percentile), SSVC marks exploitation as 'none' and automatable 'no', and there is no public exploit identified at time of analysis, so this is not yet a mass-scan target. However, SSVC technical impact is 'total' and request-smuggling primitives historically enable auth bypass against reverse-proxy architectures, so any Undertow instance sitting behind a proxy (HAProxy, nginx, F5, CDN) that enforces security policy should be treated as priority-patch even though scanners are not yet weaponizing it.

An attacker sends a single crafted HTTP/1.1 request to a CDN or reverse proxy fronting a JBoss EAP application; the proxy parses header names normally and forwards the request, but Undertow's lenient parser splits the body into a second smuggled request that targets an internal admin endpoint, bypassing the proxy's authentication check. The smuggled request executes in the context of the next legitimate user's connection, allowing the attacker to access unauthorized resources or poison cached responses. No public exploit is identified at time of analysis, but request smuggling against Undertow is a well-documented research area with reusable Burp Suite tooling.