What is CVE-2026-28368?

CVE-2026-28368 is a high-severity vulnerability in Red Hat Build Of Apache Camel For Spring Boot 4, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 8.7/10. Published 2026-03-27.

How severe is CVE-2026-28368?

High severity. CVSS v3 base score is 8.7 out of 10.

Vulnerability in Red Hat Build Of Apache Camel For Spring Boot 4

CVE-2026-28368

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

Vulnerability class: HTTP Request Smuggling

Published 2026-03-27 · last modified 2026-10-14.

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.009 (58.5th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.009 · change: +0.002

Affected products

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

References

access.redhat.com/security/cve/CVE-2026-28368 (vdb-entry, Vendor Advisory)
bugzilla.redhat.com/show_bug.cgi (issue-tracking, Issue Tracking, Vendor Advisory)
access.redhat.com/errata/RHSA-2026:25125 (vendor-advisory)
access.redhat.com/errata/RHSA-2026:25126 (vendor-advisory)

Frequently asked questions

What is CVE-2026-28368?: CVE-2026-28368 is a high-severity vulnerability in Red Hat Build Of Apache Camel For Spring Boot 4, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 8.7/10. Published 2026-03-27.
How severe is CVE-2026-28368?: High severity. CVSS v3 base score is 8.7 out of 10.