CVE-2026-28367CRITICAL 8.7EPSS p48.5%

CVE-2026-28367CVE-2026-28367

redhat / build_of_apache_camel_-_hawtio

Description

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

Scoring

CVSS 3.18.7 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS0.71% probability of exploitation · percentile 48.5% · 2026-06-19T12:03:05Z
Published2026-03-27
Last modified2026-06-10

Underlying weaknesses· 1

CWE-444

References

  1. https://access.redhat.com/security/cve/CVE-2026-28367
  2. https://bugzilla.redhat.com/show_bug.cgi?id=2443260

1

TypeTargetConfidenceTier
WeaknessInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')cwe-4440%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-28368
CVE
CVE-2026-28369
CVE
CVE-2026-1502
CVE
CVE-2025-22871
CVE
CVE-2025-12543
CVE
CVE-2025-12642
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.