Is CVE-2026-28369 being actively exploited?

CVE-2026-28369 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2026-28369?

CVE-2026-28369 has a CVSS 3.1 base score of 8.7 (HIGH).

CVE-2026-28369

HIGH · CVSS 8.7EPSS 0.9%EU EUVD

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.

Key facts

CVSS score: 8.7 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-444
EPSS score: 0.9% (58th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2026-16698)
Published: March 27, 2026
NVD last modified: October 14, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-16698 in the EU Vulnerability Database. Last updated in EUVD on October 14, 2026.

View on the EU Vulnerability Database

Affected products

redhat / build of apache camel - hawtio
redhat / build of apache camel for spring boot
redhat / data grid
redhat / enterprise linux
redhat / fuse
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform expansion pack
redhat / process automation
redhat / single sign-on
redhat / undertow

Certified products that may be affected

8 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5034 - active
Red Hat Enterprise Linux 9 NSS Cryptographic Module - Red Hat, Inc - FIPS 140 5022 - active
Red Hat Enterprise Linux 9 gnutls - Red Hat, Inc. - FIPS 140 4846 - active

See all 8 in the Security Certifications Explorer.

References

https://access.redhat.com/errata/RHSA-2026:25125
https://access.redhat.com/errata/RHSA-2026:25126
https://access.redhat.com/security/cve/CVE-2026-28369(Vendor Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=2443262(Issue Tracking, Vendor Advisory)

Last updated October 15, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain