CVE-2026-28367: Request Smuggling in Apache Undertow

The core of this vulnerability lies in Undertow's handling of header block terminators. By injecting \r\r\r into a header, an attacker can trick Undertow into prematurely ending the header section of a request. This can be exploited in conjunction with proxy servers that don't properly normalize or validate headers. The resulting request smuggling allows an attacker to craft malicious requests that are interpreted differently by the proxy and Undertow, potentially bypassing security controls. For example, an attacker could inject a seemingly innocuous request that, when processed by the proxy, is interpreted as a request to access sensitive data or execute unauthorized commands. The blast radius extends to any downstream systems accessible through the proxy, as the smuggled request can be used to target those systems directly.

1. Reserved2026-02-27
2. Published2026-03-27
3. Modified2026-04-10
4. EPSS updated2026-04-04

The primary mitigation for CVE-2026-28367 is to upgrade to Apache Undertow version 2.5.4 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. One approach is to configure the proxy server to strictly enforce header normalization and validation, preventing the injection of malformed header terminators. Another workaround involves implementing a WAF (Web Application Firewall) rule to detect and block requests containing the suspicious \r\r\r sequence in headers. Monitor Undertow access logs for unusual patterns or unexpected requests that might indicate exploitation attempts. After upgrading, confirm the fix by sending a test request with the malicious header sequence and verifying that it is properly rejected.