8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28368

CVE-2026-28368: Undertow: undertow: request smuggling via inconsistent header parsing

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28368

CVE-2026-28368:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.undertow:undertow-parent	maven	<= 2.3.23.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-28368, is a form of HTTP request smuggling in Undertow. The root cause is the improper validation of characters within HTTP header names. The analysis of the commits between the last known vulnerable version (2.3.23.Final) and the next release (2.3.24.Final) revealed a patch that directly addresses this issue. The commit caf8e11340394ae39ec4394862fc3dd9f13644b2 modifies the io.undertow.server.Connectors class, specifically the isValidTokenCharacter and isValidSchemeCharacter methods.

The core of the vulnerability is in isValidTokenCharacter. Before the patch, this function directly used a byte from the request as an index into an array of allowed characters (ALLOWED_TOKEN_CHARACTERS) without any validation. This allowed an attacker to use byte values outside the expected range (e.g., negative values), which could cause the application to behave differently than a front-end proxy server that would correctly reject such a header. This discrepancy in parsing is the basis for a request smuggling attack.

The patch introduces a simple but effective bounds check to ensure that the byte value is a valid index for the array before access. This enforces stricter adherence to the HTTP specification for what constitutes a valid token character, closing the parsing loophole. A similar fix was applied to isValidSchemeCharacter, which had the same logical flaw.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.