A flaw exists in Undertow where header names are parsed inconsistently between the server and upstream proxies. This discrepancy, classified as CWE‑444, lets a remote attacker craft requests that the proxy interprets differently than Undertow, enabling a request smuggling attack. By smuggling a secondary request into the upstream service, an attacker can bypass normal authentication or security controls and access resources that should be protected.

The vulnerability affects several Red Hat products, including Red Hat Enterprise Linux 8, 9, and 10; Red Hat JBoss Enterprise Application Platform 7 and 8; Red Hat JBoss Fuse 7; Red Hat Process Automation 7; Red Hat Single Sign‑On 7; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; and Red Hat builds of Apache Camel HawtIO and Camel for Spring Boot 4. Any deployment that uses Undertow as its servlet container is at risk.

The CVSS score of 8.7 indicates a high severity, and while EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, the attack vector is remote and does not require authentication. An attacker can send specifically crafted HTTP requests over the network to an exposed Undertow‑based service, with the headers interpreted differently by a proxy, to smuggle hidden requests into downstream systems. Successful exploitation could result in unauthorized data access, privilege escalation, or disruption of service.