Chunked Transfer Encoding Vulnerability in Undertow Server by Red Hat

CVE-2026-14180

What is CVE-2026-14180?

A flaw exists in the ChunkReader component of the Undertow HTTP server utilized by WildFly and JBoss EAP for managing chunked transfer encoding. The vulnerability arises from the parser's use of a single internal variable intended to track both the remaining size of chunks and state flags. An attacker can exploit this issue by submitting a carefully crafted request with a significantly large chunk size, leading to an overlap of these values. This condition can mislead the parser into prematurely concluding that a request has been processed, allowing a second 'smuggled' request to be executed out of sequence, potentially enabling the bypass of critical security measures.

References