CVE-2026-14180
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in the ChunkReader component of the Undertow HTTP server, used by WildFly and JBoss EAP for chunked transfer encoding. The parser uses a single internal variable for both remaining chunk size and state flags, allowing an attacker to craft a request with an extremely large chunk size to overlap these values, tricking the parser into thinking a request has finished prematurely and enabling request smuggling.
Risk Assessment
The vulnerability could allow bypassing security controls and request smuggling attacks, potentially leading to unauthorized access or data manipulation.
Recommendation
Update Undertow to a patched version and monitor HTTP traffic for unusual requests with large chunk sizes.
Original NVD description (English source)
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.