Loading story…
Red Hat disclosed two high-severity request smuggling vulnerabilities in Undertow, tracked as CVE-2026-28367 and CVE-2026-28368, that let remote attackers exploit parsing differences between Undertow and upstream proxies. Both issues are classified as CWE-444 and carry a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating network-reachable attacks with high confidentiality and integrity impact.
CVE-2026-28367 allows attackers to use \r\r\r as a header block terminator to smuggle requests when Undertow sits behind certain proxy servers, with older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer specifically cited as exposed configurations. CVE-2026-28368 stems from inconsistent header-name parsing between Undertow and upstream proxies, creating another path to bypass security controls and reach unauthorized resources through crafted requests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-27, a second Undertow vulnerability, CVE-2026-28368, was reported. The issue stems from inconsistent header-name parsing between Undertow and upstream proxies, creating a request smuggling condition that could bypass security controls and expose unauthorized resources.
On 2026-03-27, Red Hat documented CVE-2026-28367 in Undertow. The flaw allows remote attackers to use `\r\r\r` as a header block terminator to trigger request smuggling behind certain proxies, including older Apache Traffic Server versions and Google Cloud Classic Application Load Balancer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple ways HTTP header injection can occur when applications place untrusted input into response headers, showing that obsolete line folding and encoding edge cases can turn filtered data into new headers. One documented path abused **Linear White Space (LWS)** permitted under `RFC 2616`, where folded header lines could be interpreted inconsistently by browsers; Internet Explorer through IE11 could treat a folded continuation line as a separate header, enabling response splitting and browser-side script execution with impact similar to cross-site scripting. Later guidance in `RFC 7230` deprecated this folding behavior and prohibited senders from emitting it in most cases. A separate case in the Java web server **Undertow** (`CVE-2018-1067`) showed how CR/LF filtering could be bypassed even when direct newline characters were blocked. Undertow validated Java `char` values before converting them to bytes, allowing attackers to use multibyte characters such as `U+560A` that truncated to `0x0A` during conversion and reintroduced a newline into the HTTP header stream. The flaw was fixed by checking for CR/LF after byte conversion, while broader mitigations across both cases include rejecting or sanitizing carriage return and line feed characters, avoiding validation before transformation, and relying on modern platform protections that enforce stricter header handling.
Aug 15, 2026
PortSwigger Research disclosed an AI-assisted system called **HTTP Terminator** that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a **dual-matching `Content-Length`** desync pattern, a **dangling-byte** weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed **response forking**. The work also uncovered and helped patch **Apache Traffic Server** zero-day **`CVE-2026-63078`**, while exposing exploitable issues involving **F5 Big-IP**, **BeyondTrust Secure Remote Access**, **Citrix NetScaler**, and some **Azure Application Gateway** plus **Akamai** deployments. A related PortSwigger paper detailed **CRLF-powered desync attacks** that turn HTTP header injection in misconfigured **Nginx**, **OpenResty**, and **Tengine** environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable **XSS**, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of **`$uri`** or **`$document_uri`** in `proxy_pass` or `return` directives, reviewing upstream proxy configurations, and enabling **HTTP/2 upstream** where possible.
Aug 13, 2026
Two high-severity vulnerabilities in **OAuth2 Proxy** can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. `CVE-2026-34457` affects versions prior to **7.15.2** when OAuth2 Proxy is used with **auth_request**-style integrations such as nginx `auth_request` and either `--ping-user-agent` or `--gcp-healthchecks` is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as **CWE-290** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-40575`, affects OAuth2 Proxy versions **7.5.0 through 7.15.1** when `--reverse-proxy` is enabled alongside `--skip-auth-regex` or `--skip-auth-route`. In those setups, the product may trust a client-supplied `X-Forwarded-Uri` header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in **OAuth2 Proxy 7.15.2**. Recommended mitigations include upgrading immediately, stripping or overwriting `X-Forwarded-Uri`, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Jun 29, 2026