CVE-2026-28368: build of apache camel - hawtio 4.0; +24 more affected products

Affected technology

build of apache camel - hawtio · 4.0
redhat

build of apache camel for spring boot · 4.0
redhat

data grid · 8.0
redhat

fuse · 7.0.0
redhat

jboss enterprise application platform · 7.0.0
redhat

jboss enterprise application platform · 8.0.0
redhat

jboss enterprise application platform expansion pack · Version not applicable in the source CPE
redhat

process automation · 7.0
redhat

single sign-on · 7.0
redhat

undertow · Version not applicable in the source CPE
redhat

enterprise linux · 9.0
redhat

Red Hat JBoss Enterprise Application Platform 8.1.6 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Apache Camel for Spring Boot 4 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Apache Camel - HawtIO 4 · Exact affected versions not specified by the source
Red Hat

Red Hat Data Grid 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 10 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Fuse 7 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 7 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform 8 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform Expansion Pack · Exact affected versions not specified by the source
Red Hat

Red Hat Process Automation 7 · Exact affected versions not specified by the source
Red Hat

Red Hat Single Sign-On 7 · Exact affected versions not specified by the source
Red Hat

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote attacker can construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. Vendor/CNA’s CVSS 3.1 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.