The vulnerability CVE-2026-28367 resides in the Undertow component of Red Hat JBoss Enterprise Application Platform 8.1. It arises from inconsistent interpretation of HTTP request headers, specifically when '\r\r\r' is used as a header block terminator. This inconsistency can be exploited by remote attackers to perform HTTP request smuggling attacks against certain proxy servers, including older Apache Traffic Server versions and Google Cloud Classic Application Load Balancer. The issue is addressed by Red Hat in an important security update (8.1.6) that fixes this and related request smuggling vulnerabilities. The CVSS v3.1 base score is 8.7, indicating high severity with network attack vector, high impact on confidentiality and integrity, no privileges required, and no user interaction needed. The vendor advisory confirms the availability of a patch and recommends applying the update after ensuring prior errata are applied and backing up systems.

Successful exploitation of this vulnerability can lead to HTTP request smuggling attacks, which may allow an attacker to bypass security controls, gain unauthorized access, or manipulate web requests processed by the affected application platform. The CVSS score of 8.7 reflects a high impact on confidentiality and integrity, with no impact on availability. The vulnerability affects the Undertow component used in Red Hat JBoss Enterprise Application Platform 8.1, potentially impacting Java applications relying on this platform when deployed behind vulnerable proxy servers.

Red Hat has released an important security update for JBoss Enterprise Application Platform 8.1 (version 8.1.6) that addresses CVE-2026-28367 along with related request smuggling vulnerabilities. Users should apply this update promptly after ensuring all previously released errata are applied and backing up their installations, including applications, configuration files, and databases. The vendor manages remediation for this cloud-hosted service, and administrators should consult the Red Hat advisories at https://access.redhat.com/errata/RHSA-2026:25125 and https://access.redhat.com/errata/RHSA-2026:25126 for detailed patching instructions and confirmation of fix status.