A flaw in Undertow, a component in many Red Hat products, allows a remote attacker to craft HTTP requests in which header names are parsed differently by Undertow compared to upstream proxies. This inconsistent header interpretation can be exploited to smuggle requests, bypassing security controls and accessing resources that should be protected. The weakness is classified as CWE‑444, a mismatch in protocol interpretation.

The vulnerability affects several Red Hat offerings that embed Undertow, including Red Hat Data Grid 8, Red Hat Enterprise Linux 8, 9 and 10, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8 (with the Expansion Pack), Red Hat Process Automation 7, Red Hat Single Sign‑On 7, and Red Hat builds of Apache Camel HawtIO 4 and Camel for Spring Boot 4. Specific version details are not listed in the CNA data, so all versions present in these products should be considered potentially vulnerable until an update is applied.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1 % suggests a currently low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote network via HTTP, where an attacker can send crafted requests that exploit the header‑parsing mismatch on an Undertow instance or a proxy forwarding to it. Successful exploitation can lead to request smuggling that bypasses security checks and grants unauthorized access or manipulation of resources.