PT-2026-28377 · Undertow · Undertow

Osidb Bzimport · Publicado 2026-03-27 · Atualizado 2026-06-10 · CVE-2026-28368

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description A security issue exists in Undertow that allows a remote attacker to create malicious requests. The issue stems from discrepancies in how Undertow parses header names compared to upstream proxies, which can be exploited to launch request smuggling attacks. Successful exploitation could bypass security measures and grant access to unauthorized resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2026-28368

GHSA-8V4X-MGVP-P658

Produtos afetados

Undertow

Referências · 15

• https://github.com/undertow-io/undertow · Nota
• https://access.redhat.com/errata/RHSA-2026:25126 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-28368 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2037669885116084503 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-28368 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:25125 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2037586204921610543 · Publicação no Twitter
• https://bugzilla.redhat.com/show_bug.cgi?id=2443261 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-28368 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-28368 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8v4x-mgvp-p658 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28368 · Aviso do Fabricante
• https://t.me/cveNotify/166952 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28368 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28368 · Nota de Segurança