CVE-2026-28367

CVE-2026-28367 describes a flaw in Undertow where a remote attacker can exploit a vulnerable header termination by sending the sequence \r\r\r. This enables potential request smuggling with certain proxies (e.g., older Apache Traffic Server and Google Cloud Classic Application Load Balancer), pot...