CVE-2026-28368: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Red Hat Red Hat JBoss Enterprise Application Platform 8.1
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
AI Analysis
Technical Summary
This vulnerability arises from Undertow's inconsistent interpretation of HTTP request headers compared to upstream proxies, allowing remote attackers to craft specially malformed HTTP requests that exploit this discrepancy to perform HTTP request smuggling. This can lead to bypassing security controls and unauthorized resource access. The issue affects Red Hat JBoss Enterprise Application Platform versions from 8.1.0 up to but not including 8.1.6. Red Hat has released an important security update in version 8.1.6 that addresses this vulnerability along with related request smuggling issues.
Potential Impact
Successful exploitation of this vulnerability can allow remote attackers to bypass security controls by smuggling HTTP requests, potentially gaining unauthorized access to protected resources. The CVSS v3.1 base score is 8.7 (High), indicating a significant impact on confidentiality and integrity without requiring privileges or user interaction. Availability impact is not affected.
Mitigation Recommendations
A security update is available in Red Hat JBoss Enterprise Application Platform version 8.1.6 that fixes this vulnerability. Users should apply this official patch to remediate the issue. Before updating, ensure all prior errata are applied and back up existing installations and configurations. No alternative mitigations are specified by the vendor advisory.
CVE-2026-28368: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Red Hat Red Hat JBoss Enterprise Application Platform 8.1
Description
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
CVSS v3.1
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from Undertow's inconsistent interpretation of HTTP request headers compared to upstream proxies, allowing remote attackers to craft specially malformed HTTP requests that exploit this discrepancy to perform HTTP request smuggling. This can lead to bypassing security controls and unauthorized resource access. The issue affects Red Hat JBoss Enterprise Application Platform versions from 8.1.0 up to but not including 8.1.6. Red Hat has released an important security update in version 8.1.6 that addresses this vulnerability along with related request smuggling issues.
Potential Impact
Successful exploitation of this vulnerability can allow remote attackers to bypass security controls by smuggling HTTP requests, potentially gaining unauthorized access to protected resources. The CVSS v3.1 base score is 8.7 (High), indicating a significant impact on confidentiality and integrity without requiring privileges or user interaction. Availability impact is not affected.
Mitigation Recommendations
A security update is available in Red Hat JBoss Enterprise Application Platform version 8.1.6 that fixes this vulnerability. Users should apply this official patch to remediate the issue. Before updating, ensure all prior errata are applied and back up existing installations and configurations. No alternative mitigations are specified by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-02-27T04:42:16.439Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2026:25125","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:25126","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-28368","vendor":"Red Hat"}]
Threat ID: 69c6c6913c064ed76fdc2953
Added to database: 03/27/2026, 18:04:01 UTC
Last enriched: 06/29/2026, 22:33:02 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 322
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.