CVE-2026-28368

The Undertow HTTP server library used in WildFly, JBoss EAP, and other Java applications does not properly validate the Host header, allowing malicious requests to be processed.

A vulnerability was found in Undertow that impacts a server supporting the wildfly-http-client protocol. When a malicious user opens and closes a connection with the HTTP port and then closes it immediately, the server may exhaust memory and open file limits. During HTTP upgrade to remoting, WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener, leading to a leak of the entire dependency tree.

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

A flaw in Undertow, an HTTP server, in its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers, leading to truncation into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

A flaw was found in the ChunkReader component of the Undertow HTTP server, used by WildFly and JBoss EAP for chunked transfer encoding. The parser uses a single internal variable for both remaining chunk size and state flags, allowing an attacker to craft a request with an extremely large chunk size to overlap these values, tricking the parser into thinking a request has finished prematurely and enabling request smuggling.

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

The Undertow AJP listener honors forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

In Undertow, when the first header line of an HTTP request starts with one or more spaces, the server strips these spaces, violating HTTP standards. A remote attacker can exploit this for request smuggling.

A flaw in Undertow allows HTTP request smuggling via the `\r\r\r` header terminator. This can be exploited with certain proxy servers like older Apache Traffic Server and Google Cloud Classic Application Load Balancer.

CVE-2026-3260 has been rejected because Undertow enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) with a body exceeding this limit is safely dropped, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.