The issue arises in Undertow when a request header begins with whitespace. Undertow strips the leading spaces, violating HTTP specifications and enabling request smuggling. A remote attacker can craft such headers to cause the server to misinterpret requests, allowing them to bypass authentication checks, duplicate or collide HTTP messages, manipulate server-side caches, and potentially read or modify sensitive data. This flaw can lead to unauthorized data exposure or actions against the affected system.

Affected vendors include Red Hat, whose products rely on Undertow in several offerings. The vulnerable products list includes Red Hat Data Grid 8, Red Hat Enterprise Linux 10, 8, and 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8, Red Hat Process Automation 7, Red Hat Single Sign‑On 7, and Red Hat builds of Apache Camel – HawtIO 4 and Camel for Spring Boot 4. Version details are not provided, so any deployment using Undertow within these products is potentially affected.

The CVSS score of 8.7 indicates a high‑impact vulnerability. EPSS is not available and the issue is not listed in KEV, suggesting no known exploitation campaigns yet, but the nature of the flaw allows remote exploitation over HTTP. An attacker only needs network access to the affected service and can manipulate the HTTP traffic to perform smuggling. As the flaw violates standards, validators and proxies that enforce correct header formatting could mitigate the risk until a patch is applied.