The vulnerability resides in Undertow, where a remote attacker can send three consecutive carriage return characters (\r\r\r) as the header block terminator. This malformed terminator is interpreted by some older HTTP gateway software as the end of the header section, allowing an attacker to split a single logical request into multiple physical requests. The resulting request smuggling can lead to unauthorized access or manipulation of web requests, enabling the attacker to bypass security controls, read or overwrite sensitive data, or trigger unintended operations. The weakness is classified as HTTP Request Smuggling (CWE‑444).

Affected products include several Red Hat distributions that embed Undertow, such as Red Hat Enterprise Linux 8, 9 and 10, Red Hat Data Grid 8, Red Hat Fuse 7, the JBoss Enterprise Application Platform 7 and 8 along with their Expansion Packs, Red Hat Process Automation 7, Red Hat Single Sign‑On 7, and Red Hat builds of Apache Camel – HawtIO 4 and Apache Camel for Spring Boot 4. The specific versions impacted are not explicitly listed in the advisory, but the caveat applies to all releases that contain the vulnerable Undertow component before it receives an official fix from Red Hat.

The issue carries a CVSS score of 8.7, indicating high severity, but the EPSS score of less than 1 % suggests the likelihood of exploitation at this time is low. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly known exploits have been documented. The attack requires a remote attacker to craft a request that uses the non‑standard \r\r\r terminator and the traffic must pass through a proxy or load balancer that incorrectly parses headers, such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. Given the need for specific gateway behavior, exploitation success is contingent upon the presence of those intermediaries.