DEBIAN-CVE-2026-91920: Medium severity debian/undertow vulnerability
A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs network access to send a specially crafted HTTP request using chunked transfer encoding. No authentication or user interaction is required.
What is the practical impact of successful exploitation?
The server can treat the request body as complete too early and parse the remaining bytes as a separate request. This enables HTTP request smuggling and can affect request integrity and service availability.
Which deployments should be prioritized for investigation?
Prioritize Undertow deployments that accept HTTP requests with chunked transfer encoding, particularly internet-facing services or services behind proxies where request parsing differences could amplify request-smuggling impact.