Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-14180

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • io.undertow/undertow-core

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • moditect

    Version range not reported

  • pki-core:10.6/resteasy

    Version range not reported

  • pki-deps:10.6/resteasy

    Version range not reported

  • resteasy

    Version range not reported

  • undertow-core

    Version range not reported

  • eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8

    Version range not reported

  • eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8

    Version range not reported

  • eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8

    Version range not reported

  • jboss-eap-7/eap74-els-openjdk17-openshift-rhel8

    Version range not reported

  • jboss-eap-7/eap74-els-openjdk8-openshift-rhel8

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

References 6

access.redhat.com

bugzilla.redhat.com