The vulnerability CVE-2026-28369 affects the Undertow HTTP server used in Red Hat JBoss Enterprise Application Platform 8.1. When an HTTP request's first header line starts with one or more spaces, Undertow incorrectly strips these leading spaces, violating HTTP protocol standards. This inconsistent interpretation of HTTP headers can be exploited remotely to perform HTTP request smuggling. Such attacks may allow an adversary to bypass security mechanisms, gain unauthorized access to sensitive information, or manipulate web caches. Red Hat has issued a security update in version 8.1.6 that fixes this issue along with related Undertow request smuggling vulnerabilities.

Successful exploitation of this vulnerability allows remote attackers to perform HTTP request smuggling against affected Red Hat JBoss Enterprise Application Platform 8.1 instances. This can lead to bypassing security controls, unauthorized access to restricted information, and manipulation of web caches. The CVSS v3.1 base score is 8.7 (High), reflecting the potential for significant confidentiality and integrity impact without requiring authentication. There are no known exploits in the wild at the time of this advisory.

Red Hat has released an official security update in Red Hat JBoss Enterprise Application Platform version 8.1.6 that addresses this vulnerability. Users should apply this update promptly. Before updating, ensure all previous errata are applied and back up existing installations, including applications, configurations, and databases. No other mitigations are specified by the vendor. Patch status is confirmed by Red Hat advisories RHSA-2026:25125 and RHSA-2026:25126.