SZB-d7f7e6e249
EUVD-2026-113473 flaw reported in Undertow ChunkReader (CVSS 6.5)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Undertow
- Product
- Undertow web server
- First seen
Summary
The EUVD entry describes a flaw in the ChunkReader component of Undertow, where a chunk-size security check runs before the value is shifted. A specially crafted 15-digit chunk size can exploit this, and the entry is scored 6.5 under CVSS v3.1.
If you use Undertow
Check whether your Undertow version is affected and review the EUVD entry
Apply the vendor's patched Undertow release when available
Restrict or monitor inbound HTTP requests with unusual chunk sizes
What the sources say 1
· Mastodon: “A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests.” Source