CVE-2026-14180: Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
Other sources
A request desynchronization vulnerability exists in Undertow's chunked transfer encoding parser. The ChunkReader.state field uses a long value to track both the remaining bytes in a chunk and internal state flags (such as FLAGFINISHED at bit 62 and FLAGREADINGAFTERLAST at bit 58). When a client sends a chunk-size header with a value large enough to set these high-order bits (e.g., 0x4000000000000000 or 0x0400000000000000), the parser incorrectly interprets the chunk or the entire request as completed. Because this logic error occurs during the parsing of the chunk header itself, default entity size limits (like max-post-size) are not triggered, as no body bytes have been consumed yet. Concrete Impact: An attacker can use this flaw to perform HTTP Request Smuggling. Specifically, they can: Force the server to treat part of a single TCP stream as a new, independent request.
Bypass security filters or routing rules implemented at the proxy/gateway level.
Cause request desynchronization where one user's request is prepended to another user's subsequent request on the same connection.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-14180?
The risk level of CVE-2026-14180 is rated as medium with a score of 5.3.
How does CVE-2026-14180 affect Undertow HTTP server?
CVE-2026-14180 affects the ChunkReader component of the Undertow HTTP server by allowing HTTP request smuggling through oversized chunk-size bit overlap.
What systems are impacted by CVE-2026-14180?
CVE-2026-14180 impacts WildFly and JBoss EAP, which utilize the Undertow HTTP server.
How can I mitigate CVE-2026-14180?
To mitigate CVE-2026-14180, it is recommended to update to the latest release of WildFly or JBoss EAP that addresses this vulnerability.
Is authentication required to exploit CVE-2026-14180?
No authentication is required to exploit CVE-2026-14180, as it can be triggered by sending specially crafted HTTP requests.