CVE-2026-28368: redhat build_of_apache_camel_-_hawtio HTTP Request/Response Smuggling
Vulnerability summary
CVE-2026-28368 is a critical (CVSS 9.1) HTTP Request/Response Smuggling vulnerability in redhat build_of_apache_camel_-_hawtio. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA8.7HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated8.7HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
+0.18 pp
From 0.70% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat10 products
- build_of_apache_camel_-_hawtio4.0
- build_of_apache_camel_for_spring_boot4.0
- data_grid8.0
- enterprise_linux9.0
- fuse7.0.0
Debian1 product
- undertowAll versions (No fix recorded)
Io.undertow1 product
- undertow-parent≤ 2.3.23.Final
Ubuntu1 product
- undertowAll versions (No fix recorded)
4 vendors · 13 products
