PT-2026-28378 · Undertow · Undertow

Bzimport · Publicado 2026-03-27 · Atualizado 2026-06-10 · CVE-2026-28369

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description A flaw exists in Undertow where the software incorrectly processes HTTP requests containing leading spaces in the first header line, violating HTTP standards. This can be exploited to perform request smuggling, potentially allowing a remote attacker to bypass security mechanisms, access restricted information, or manipulate web caches, leading to unauthorized actions or data exposure. Request smuggling involves crafting malicious requests that are misinterpreted by the server, allowing an attacker to control how requests are processed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2026-28369

GHSA-VQQJ-9CMV-HX43

Produtos afetados

Undertow

Referências · 16

• https://github.com/undertow-io/undertow · Nota
• https://ubuntu.com/security/CVE-2026-28369 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-28369 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:25126 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28369 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2037635939321995347 · Publicação no Twitter
• https://access.redhat.com/security/cve/CVE-2026-28369 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2443262 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28369 · Nota de Segurança
• https://twitter.com/RedHornet_Intel/status/2041133998244532319 · Publicação no Twitter
• https://access.redhat.com/errata/RHSA-2026:25125 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2037586238824173714 · Publicação no Twitter
• https://t.me/cveNotify/166953 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-vqqj-9cmv-hx43 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-28369 · Nota de Segurança