EUVD-2026-16698
GHSA-vqqj-9cmv-hx43
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify Undertow behind permissive proxy
-
DeliveryCraft request with space-prefixed header
-
ExploitSend via HTTP/1.1 keep-alive connection
-
InstallProxy forwards unmodified, Undertow strips whitespace
-
C2Smuggled request parsed on shared connection
-
ExecuteHijack next user session or poison cache
-
ImpactExfiltrate data or reach internal endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
|
| Exploitation Conditions | Exploitation requires that Undertow be deployed behind an HTTP intermediary (reverse proxy, load balancer, CDN, or API gateway) that tolerates and forwards requests with leading whitespace on the first header line - a desync only manifests when two parsers disagree. The attacker needs only HTTP/1.1 network reachability to that front-end, no authentication, and no user interaction (CVSS PR:N/UI:N). Limiting factors: direct exposure of Undertow with no proxy eliminates the desync primitive; front-ends that strictly reject whitespace-prefixed headers per RFC 7230 (recent nginx, Apache httpd with ModSecurity, AWS CloudFront with strict parsing) block the attack; HTTP/2-only fronthauls without HTTP/1.1 downgrade are unaffected; and successful impact (cache poisoning, session hijack, ACL bypass) depends on the presence of a shared cache or pooled backend connection. |
| Impact | Signals diverge sharply. CVSS 3.1 is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflecting unauthenticated network exploitability with high confidentiality and integrity impact. CISA SSVC, however, scores Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.13% (32nd percentile) - consistent with a smuggling primitive that is powerful but topology-dependent and not yet weaponised against this server. The vulnerability is not on the CISA KEV list. Real-world risk is concentrated where Undertow sits behind a reverse proxy that accepts whitespace-prefixed headers; deployments fronted by stricter proxies or exposed directly are materially lower risk. Treat as a high-priority patch for any internet-facing JBoss EAP, Data Grid, or Camel-on-Spring-Boot tier fronted by HTTP intermediaries, but do not over-rotate purely on the 9.1 score. |
| Exploit ScenarioDerived | An attacker fronted by a permissive reverse proxy sends a single TCP request whose first header line is prefixed with a space; the proxy forwards both the visible request and the smuggled payload as one stream, while Undertow strips the space and parses the smuggled bytes as a second request that inherits the next legitimate user's connection. The attacker thereby poisons a shared response cache, hijacks the victim's session cookie on the next request, or reaches an internal admin endpoint normally blocked at the proxy. No public exploit identified at time of analysis, but generic HTTP smuggling toolkits (e.g. http-request-smuggler, Smuggler.py) can be adapted with minimal effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 10, 2026
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
Earlier versions of this analysis (2)
HTTP request smuggling in Undertow (Red Hat's Java web server used in JBoss EAP, Data Grid, and Apache Camel builds) allows remote unauthenticated attackers to bypass front-end security controls by sending requests whose first header line begins with leading whitespace, which Undertow strips in violation of RFC 7230. CVSS scores this 9.1 (high confidentiality and integrity impact) but EPSS sits at only 0.13% (32nd percentile) and CISA SSVC reports no observed exploitation - no public exploit identified at time of analysis. Risk is highest in proxy/cache fronted deployments where smuggled requests can poison caches or reach restricted endpoints.
Undertow's improper handling of HTTP requests with leading whitespace in header lines enables remote, unauthenticated request smuggling attacks (CWE-444) against Red Hat middleware and enterprise products. Attackers can exploit this HTTP standard violation to bypass security controls, access restricted data, or poison web caches across a wide deployment base including JBoss EAP 7/8, Red Hat Fuse 7, Data Grid 8, and RHEL 8/9/10 distributions. The CVSS score of 8.7 with changed scope (S:C) and high attack complexity (AC:H) indicates significant impact potential, though no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory: apply Red Hat errata RHSA-2026:25125 and RHSA-2026:25126 (https://access.redhat.com/errata/RHSA-2026:25125, https://access.redhat.com/errata/RHSA-2026:25126) to update Undertow across affected JBoss EAP, Data Grid, Fuse, Camel, and RHEL channels; exact fixed Undertow versions are not enumerated in the supplied data, so confirm the build via the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-28369 and Bugzilla 2443262. Until patching, place an RFC-strict reverse proxy in front of Undertow that rejects requests whose first header line begins with whitespace (modern nginx, Apache httpd with mod_security CRS rule 920270, or HAProxy with 'option http-no-strict' disabled) - the trade-off is potential breakage of any non-conforming clients. Disable HTTP/1.1 keep-alive or connection reuse on the proxy-to-Undertow leg to neutralise the smuggling primitive at the cost of throughput, and segregate sensitive endpoints behind a separately-fronted listener so a successful smuggle cannot pivot between security zones.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Undertow is the high-performance non-blocking HTTP server written by Red Hat and embedded across the JBoss/WildFly ecosystem, Red Hat Data Grid 8, Fuse 7, and the Camel for Spring Boot/Hawtio 4 distributions. The flaw is a CWE-444 Inconsistent Interpretation of HTTP Requests: per RFC 7230 §3, a request line and header field-name must not be preceded by whitespace, and conformant intermediaries must reject such messages. Undertow instead silently strips leading whitespace from the first header line, so a request that an upstream proxy (HAProxy, nginx, Apache, an API gateway, or AWS ALB) interprets one way is reframed by Undertow as a different request - the classic precondition for HTTP request/response smuggling against a shared TCP connection or cache.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated, but AC:H because exploitation depends on a permissive front-end proxy; scope changes as smuggled requests cross the proxy/server trust boundary, high C/I, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
Executive ViewAI
HTTP request smuggling in Undertow-the web server embedded in widely-deployed Red Hat middleware including JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot-enables unauthenticated remote attackers to evade security controls. While no public exploit has been identified at present, this CVSS 9.1 critical vulnerability creates significant risk of authentication and authorization bypass on enterprise applications. Immediate inventory of affected systems and network-level controls are required pending vendor patching.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) WAF rules blocking HTTP requests with leading whitespace in header lines; (2) reverse proxy hardening to enforce RFC 7230 header parsing standards; (3) network segmentation restricting access to affected Undertow instances; (4) enhanced request logging and monitoring for header anomalies; (5) consideration of temporary service relocation to patched Undertow versions if critical applications are verified affected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Exploit-DB