CVE-2026-28367

redhat build of apache camel - hawtio, redhat build of apache camel for spring boot, redhat data grid +6 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-28367

Katalog CVE

CVSS 9.1 · Critical EPSS 0,89%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada redhat build of apache camel - hawtio, redhat build of apache camel for spring boot +7 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

Rincian

Terbit di NVD
27 Maret 2026
Terakhir diubah
21 September 2026
Status NVD
Modified
CVSS 3.1
9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
EPSS (30 hari)
0,89% peluang dieksploitasi; lebih tinggi dari 58,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
redhat build of apache camel - hawtio Versi 4.0
redhat build of apache camel for spring boot Versi 4.0
redhat data grid Versi 8.0
redhat fuse Versi 7.0.0
redhat jboss enterprise application platform Versi 7.0.0
redhat jboss enterprise application platform Versi 8.0.0
redhat jboss enterprise application platform expansion pack Semua versi
redhat process automation Versi 7.0
redhat single sign-on Versi 7.0
redhat undertow Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.