PT-2026-28376 · Apache+2 · Apache Traffic Server+2

CVE-2026-28367 · Publicado 2026-03-27 · Atualizado 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description A flaw exists in Undertow that allows a remote attacker to exploit the software by sending rrr as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2026-28367

GHSA-3GV6-G396-9V4R

RHSA-2026:25125

Produtos afetados

Apache Traffic Server

Google Cloud Classic Application Load Balancer

Undertow

Referências · 17

• https://github.com/undertow-io/undertow · Nota
• https://access.redhat.com/errata/RHSA-2026:25125 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:25126 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-28367 · Aviso do Fabricante
• https://twitter.com/RedHornet_Intel/status/2041139523296370995 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28367 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-28367 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2037669837166743898 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28367 · Nota de Segurança
• https://t.me/cveNotify/166951 · Publicação no Telegram
• https://bugzilla.redhat.com/show_bug.cgi?id=2443260 · Aviso do Fabricante
• https://t.me/cveNotify/178390 · Publicação no Telegram
• https://access.redhat.com/security/cve/CVE-2026-28367 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28367 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-28367 · Nota de Segurança