Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-28368: A flaw was found in Undertow

54
This month
HIGH 8.7REMOTEWATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE

CVE-2026-28368 is a high-severity flaw (CVSS 8.7) affecting build of apache camel - hawtio, build of apache camel for spring boot, data grid. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

Why this priority

  • High severity
  • Remotely exploitable, no login, no user action
  • On your watchlist

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score8.7 (High)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededNone
User interactionNone
EPSS exploit chance0.7% (top 46%)
CISA exploited listNo
WeaknessCWE-444
Published2026-03-27
Last modified2026-10-26
Publisher (CNA): Red Hat, Inc. · Vendor: redhat

Share: LinkedIn · X · Reddit

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

redhat build of apache camel - hawtio DOWNGRADE
Affected: 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0
1. Check installed version
apt-cache policy build-of-apache-camel---hawtio || rpm -q build-of-apache-camel---hawtio || build-of-apache-camel---hawtio --version
2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)
apt-cache madison build-of-apache-camel---hawtio sudo apt install build-of-apache-camel---hawtio=<VERSION_BEFORE_4.0> sudo apt-mark hold build-of-apache-camel---hawtio
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list build-of-apache-camel---hawtio sudo dnf downgrade build-of-apache-camel---hawtio-<VERSION_BEFORE_4.0> sudo dnf versionlock add build-of-apache-camel---hawtio
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat build of apache camel for spring boot DOWNGRADE
Affected: 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0
1. Check installed version
apt-cache policy build-of-apache-camel-for-spring-boot || rpm -q build-of-apache-camel-for-spring-boot || build-of-apache-camel-for-spring-boot --version
2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)
apt-cache madison build-of-apache-camel-for-spring-boot sudo apt install build-of-apache-camel-for-spring-boot=<VERSION_BEFORE_4.0> sudo apt-mark hold build-of-apache-camel-for-spring-boot
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list build-of-apache-camel-for-spring-boot sudo dnf downgrade build-of-apache-camel-for-spring-boot-<VERSION_BEFORE_4.0> sudo dnf versionlock add build-of-apache-camel-for-spring-boot
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat data grid DOWNGRADE
Affected: 8.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
1. Check installed version
apt-cache policy data-grid || rpm -q data-grid || data-grid --version
2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)
apt-cache madison data-grid sudo apt install data-grid=<VERSION_BEFORE_8.0> sudo apt-mark hold data-grid
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list data-grid sudo dnf downgrade data-grid-<VERSION_BEFORE_8.0> sudo dnf versionlock add data-grid
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat fuse DOWNGRADE
Affected: 7.0.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0.0
1. Check installed version
apt-cache policy fuse || rpm -q fuse || fuse --version
2. No fixed release: DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)
apt-cache madison fuse sudo apt install fuse=<VERSION_BEFORE_7.0.0> sudo apt-mark hold fuse
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list fuse sudo dnf downgrade fuse-<VERSION_BEFORE_7.0.0> sudo dnf versionlock add fuse
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat jboss enterprise application platform DOWNGRADE
Affected: 7.0.0 · 8.0.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0.0
1. Check installed version
apt-cache policy jboss-enterprise-application-platform || rpm -q jboss-enterprise-application-platform || jboss-enterprise-application-platform --version
2. No fixed release: DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)
apt-cache madison jboss-enterprise-application-platform sudo apt install jboss-enterprise-application-platform=<VERSION_BEFORE_7.0.0> sudo apt-mark hold jboss-enterprise-application-platform
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jboss-enterprise-application-platform sudo dnf downgrade jboss-enterprise-application-platform-<VERSION_BEFORE_7.0.0> sudo dnf versionlock add jboss-enterprise-application-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat jboss enterprise application platform expansion pack MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy jboss-enterprise-application-platform-expansion-pack || rpm -q jboss-enterprise-application-platform-expansion-pack || jboss-enterprise-application-platform-expansion-pack --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-28368?

build of apache camel - hawtio: downgrade or apply the listed mitigation; build of apache camel for spring boot: downgrade or apply the listed mitigation; data grid: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2026-28368 being exploited?

CVE-2026-28368 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-28368 affect?

CVE-2026-28368 affects build of apache camel - hawtio, build of apache camel for spring boot, data grid. Severity is high (CVSS 8.7). A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation

How urgent is CVE-2026-28368?

Priority 54/100. High severity; Remotely exploitable, no login, no user action; On your watchlist

Software pages

Spring Framework vulnerabilities · JBoss and WildFly vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.