Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.undertow:undertow-parent | maven | <= 2.3.23.Final |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-28367, allows for HTTP request smuggling in Undertow. The root cause is improper handling of characters in HTTP headers. The investigation focused on the code changes between the last vulnerable version (2.3.23.Final) and the first patched version (2.3.24.Final). The key commit caf8e11340394ae39ec4394862fc3dd9f13644b2 addresses a flaw in character validation within the io.undertow.server.Connectors class.
The functions isValidTokenCharacter and isValidSchemeCharacter were modified to add bounds checking for the byte array lookups. Before the patch, a specially crafted request containing invalid characters (which could be interpreted as negative byte values) could trigger an ArrayIndexOutOfBoundsException. This exception, if occurring during the parsing of HTTP headers, can lead to a state where a front-end proxy and the Undertow backend have different views of the request boundaries. This desynchronization is the foundation of an HTTP request smuggling attack, allowing an attacker to prepend a malicious request to the next request on the same connection, potentially bypassing security controls or accessing unauthorized information.
