A flaw in Undertow permits a remote attacker to send the characters \r\r\r as a header block terminator. This non‑standard terminator causes certain proxy servers to mis‑parse HTTP requests, enabling request smuggling. The resulting smuggled request can reach backend services without the original client’s knowledge, potentially allowing the attacker to bypass access controls, alter request data, or perform other unauthorized actions. The weakness is documented as CWE‑444, a protocol downgrade or downgrade of protocol security.

This issue affects a wide range of Red Hat products that embed Undertow, including Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform versions 7 and 8, Red Hat Fuse 7, Red Hat Process Automation 7, Red Hat Single Sign‑On 7, Red Hat build of Apache Camel – HawtIO 4 and Camel for Spring Boot 4, and the Red Hat Enterprise Linux families (8, 9, 10). Specific component versions are not listed, so any release that contains the affected Undertow framework should be considered vulnerable until a patch is applied.

The CVSS score of 8.7 marks this as a high severity vulnerability. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the exploit vector is remote, requiring only the ability to send crafted HTTP requests to an Undertow server. In environments that use older proxy servers such as Apache Traffic Server or Google Cloud Classic Application Load Balancer, the smuggling can be amplified, making the risk higher for systems that expose Undertow behind such proxies.