CVE-2026-28367: Undertow Request Smuggling via Header Terminator

CVE-2026-28367 is an HTTP request smuggling flaw in Undertow, the web server used by JBoss EAP and WildFly. A request ending its headers with an unusual terminator can be misread when certain proxies sit in front. NVD scores it 8.7. Red Hat fixed it in JBoss EAP 8.1.6.

What's affected

Red Hat lists these products as affected in the NVD record: Build of Apache Camel (Hawtio), Build of Apache Camel for Spring Boot, Data Grid, Fuse, JBoss Enterprise Application Platform, JBoss EAP Expansion Pack, and Process Automation.

Red Hat shipped fixes for JBoss Enterprise Application Platform 8.1 in RHSA-2026:25125 and RHSA-2026:25126, both titled as the JBoss EAP 8.1.6 security update, rated Important. They list the three Undertow CVEs together: CVE-2026-28367, CVE-2026-28368 and CVE-2026-28369. For other Red Hat products, use the CVE page to find the matching errata.

Red Hat's statement says the risk applies when Undertow is deployed with certain proxy servers that forward the unusual terminator, naming older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer as examples. Red Hat rates its own score 8.7 and NVD lists 9.1. The weakness is CWE-444 (Inconsistent Interpretation of HTTP Requests).

How to check if you're exposed

Undertow is the web server inside JBoss EAP and WildFly, and it is also embedded in many Java applications. Find it in two places.

For Red Hat JBoss EAP, check the installed version against the errata. The fix is in the 8.1.6 security update.

For Java applications that bundle Undertow, check the dependency tree.

mvn dependency:tree -Dincludes=io.undertow:undertow-core

Gradle users can run gradle dependencies and search the output for undertow-core.

Then look at what sits in front of Undertow. These flaws depend on a proxy or load balancer that interprets the request differently, so list every proxy hop between the internet and your Java servers.

What to do now

1. Apply the JBoss EAP 8.1.6 security update or the matching Red Hat update for your product, and update bundled Undertow where you embed it.
2. Configure any proxy in front of Undertow to strictly validate header terminators. Red Hat's mitigation is for proxies to reject or normalise non-standard header block terminators before forwarding.
3. Upgrade old proxies and load balancers that are named as vulnerable partners, since the flaw needs two parties to disagree.
4. Check your WAF and access control rules are not the only line of defence for Java apps, because smuggled requests can bypass them.
5. Keep an inventory of which services embed Undertow so the next advisory takes minutes to scope.

Why it matters

Request smuggling depends on disagreement. A proxy decides where one request ends, then hands bytes to a backend that decides for itself. If the backend accepts an unusual way of ending the header block that the proxy treats as ordinary data, the two disagree about where the next request starts.

In this record, the unusual terminator is a sequence of carriage returns instead of the standard line ending. Red Hat's statement is explicit that exposure depends on proxies that forward it. The same Undertow behind a strict proxy is in a much better position.

The usual consequences apply: bypassing security controls at the proxy, cache poisoning and manipulation of web requests. Fixing the parser removes the disagreement from one side, and strict proxy configuration removes it from the other. Doing both is best.

The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.

Quick check

Sources

• Red Hat errata RHSA-2026:25125 (JBoss EAP 8.1.6)
• Red Hat errata RHSA-2026:25126 (JBoss EAP 8.1.6)
• Red Hat CVE page for CVE-2026-28367

Last reviewed: 19 October 2026.