This vulnerability arises from Undertow's inconsistent interpretation of HTTP requests, specifically when a remote attacker sends '\r\r\r' as a header block terminator. This malformed request can be used to perform HTTP request smuggling attacks against proxy servers that do not handle such input correctly, including older Apache Traffic Server versions and Google Cloud Classic Application Load Balancer. The affected product is the Red Hat build of Apache Camel for Spring Boot 4. The CVSS 3.1 score is 8.7 (high), reflecting network attack vector, high impact on confidentiality and integrity, and no required privileges or user interaction. A patch is available from Red Hat.

Successful exploitation can lead to HTTP request smuggling, potentially allowing unauthorized access or manipulation of web requests passing through vulnerable proxy servers. This can compromise confidentiality and integrity of data handled by the affected systems. Availability impact is not indicated. No known exploits in the wild have been reported at this time.

A patch is available from Red Hat to address this vulnerability. Users of the Red Hat build of Apache Camel for Spring Boot 4 should apply the official fix as provided by Red Hat. There is no indication that the vulnerability is mitigated by default or that no action is required. No additional mitigations are specified in the advisory.