CVE-2026-28367: Undertow Auth Bypass Vulnerability

CVE-2026-28367 Overview

A flaw was found in Undertow, a lightweight Java web server used in Red Hat JBoss Enterprise Application Platform. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for HTTP Request Smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

Critical Impact

This HTTP Request Smuggling vulnerability allows remote attackers to bypass security controls, access unauthorized resources, or manipulate web requests by exploiting header parsing inconsistencies between Undertow and upstream proxy servers.

Affected Products

• Undertow (all versions prior to patched release)
• Red Hat JBoss Enterprise Application Platform (versions using vulnerable Undertow)
• Applications deployed behind Apache Traffic Server (older versions)
• Applications using Google Cloud Classic Application Load Balancer

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-28367 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-28367

Vulnerability Analysis

This vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests), commonly known as HTTP Request Smuggling. The flaw exists in how Undertow parses HTTP header terminators. When a malformed header block containing \r\r\r (three consecutive carriage return characters) is sent, Undertow and certain proxy servers interpret the request boundaries differently.

HTTP Request Smuggling occurs when front-end and back-end servers disagree on where one request ends and another begins. In this case, the non-standard \r\r\r sequence is accepted by Undertow but interpreted differently by proxy servers like older Apache Traffic Server versions and Google Cloud Classic Application Load Balancer.

Root Cause

The root cause stems from Undertow's lenient parsing of HTTP header terminators. The HTTP/1.1 specification (RFC 7230) mandates that headers must be terminated by \r\n\r\n (CRLF CRLF). However, Undertow accepts \r\r\r as a valid terminator, creating a parsing discrepancy with stricter proxy implementations that adhere more closely to the RFC specification.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker positions themselves as a client sending crafted HTTP requests through a proxy to a back-end Undertow server. By embedding the malformed \r\r\r terminator, the attacker can:

1. Smuggle malicious requests - Inject additional requests that bypass the proxy's security inspection
2. Poison web caches - Store malicious responses in shared caches affecting other users
3. Hijack user requests - Prepend attacker-controlled content to legitimate user requests
4. Bypass access controls - Access restricted endpoints by manipulating request routing

The vulnerability exploits the desynchronization between the proxy server's request parsing and Undertow's interpretation. The proxy may forward what it considers a single request, while Undertow parses it as multiple requests, allowing the attacker's smuggled request to execute with potentially elevated privileges or access to restricted resources.

Detection Methods for CVE-2026-28367

Indicators of Compromise

• Unusual HTTP request patterns containing multiple carriage return characters (\r\r\r) in headers
• Unexpected responses or behavior from back-end servers that don't correlate with proxy logs
• Web cache poisoning incidents where malicious content appears in cached responses
• User reports of session hijacking or unexpected redirects

Detection Strategies

• Implement deep packet inspection to identify malformed HTTP header terminators containing \r\r\r sequences
• Monitor for discrepancies between proxy access logs and Undertow server logs indicating request smuggling
• Deploy Web Application Firewall (WAF) rules to block requests with non-standard header terminators
• Analyze network traffic for requests that contain unusual carriage return patterns

Monitoring Recommendations

• Enable verbose logging on both proxy servers and Undertow to correlate request handling
• Set up alerts for HTTP requests with malformed or non-standard header sequences
• Monitor cache hit/miss ratios for anomalies that may indicate cache poisoning attempts
• Review authentication and access logs for unauthorized endpoint access patterns

How to Mitigate CVE-2026-28367

Immediate Actions Required

• Update Undertow to the latest patched version as soon as it becomes available
• Configure strict HTTP parsing on all proxy servers to reject non-compliant requests
• Implement WAF rules to block requests containing \r\r\r header terminators
• Review and update Apache Traffic Server and other affected proxy servers to current versions

Patch Information

Red Hat has acknowledged this vulnerability and is tracking it via Bug Report #2443260. Organizations should monitor the Red Hat CVE Advisory for official patch releases and updated guidance.

Apply patches to all Undertow installations and ensure proxy servers in your infrastructure are configured to enforce strict HTTP protocol compliance.

Workarounds

• Configure proxy servers to normalize HTTP requests and reject those with non-standard header terminators
• Implement strict request validation at the network edge to block malformed HTTP sequences
• Consider deploying HTTP/2 between proxies and back-end servers, as it uses binary framing that prevents this class of vulnerability
• Temporarily disable or restrict external access to affected services until patches are applied

# Example: Configure Apache Traffic Server to use strict HTTP parsing
# In records.config, add or modify:
CONFIG proxy.config.http.strict_header_enforcement INT 1
CONFIG proxy.config.http.errors.log_error_pages INT 1

# For Google Cloud, consider migrating from Classic to Global External Application Load Balancer
# which has improved HTTP parsing and request handling