CVE-2026-28367: redhat build_of_apache_camel_-_hawtio HTTP Request/Response Smuggling
Vulnerability summary
CVE-2026-28367 is a critical (CVSS 9.1) HTTP Request/Response Smuggling vulnerability in redhat build_of_apache_camel_-_hawtio. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA8.7HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated8.7HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
+0.18 pp
From 0.71% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- build_of_apache_camel_-_hawtio4.0
- build_of_apache_camel_for_spring_boot4.0
- data_grid8.0
- fuse7.0.0
- jboss_enterprise_application_platform7.0.0 | 8.0.0
Debian1 product
- undertowAll versions (No fix recorded)
Io.undertow1 product
- undertow-parent≤ 2.3.23.Final
Ubuntu1 product
- undertowAll versions (No fix recorded)
4 vendors · 12 products
