A flaw in Undertow causes the server to strip leading spaces from the first header line of an HTTP request, violating the HTTP standard. This mishandling can be leveraged to execute request smuggling, allowing an attacker to bypass security controls, gain unauthorized access, or modify cache entries, potentially exposing confidential data or performing arbitrary actions on the server.

Red Hat products affected include Red Hat Data Grid 8, Red Hat Enterprise Linux 10, 8 and 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8 along with the expansion pack, Red Hat Process Automation 7, Red Hat Single Sign‑On 7, and the Red Hat build of Apache Camel – HawtIO 4 and of Apache Camel for Spring Boot 4. The vulnerability is present in the Undertow component used by these products; any release containing the vulnerable Undertow version is treated as impacted.

With a CVSS score of 8.7 the vulnerability is high severity, and EPSS indicates an exploitation likelihood under 1 % while it is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring the attacker to send a malicious HTTP request that begins with leading spaces. If exposed to the Internet, this provides a low‑but‑non‑negligible risk of data exposure or unauthorized intrusion via request smuggling.