A vulnerability was found in Undertow where the WebSocketContainer and its boot process do not allow setting the binaryBuffer and textBuffer sizes, along with session duration and async send timeout. These parameters default to infinite. This is a follow-up to CVE-2026-5680, as the initial fix allowed setting buffer sizes for certain types but left async send and session duration as infinite and inaccessible for configuration. An attacker could exploit these infinite defaults to cause resource exhaustion or an Out of Memory (OOME) condition on the server.

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

A request desynchronization vulnerability exists in Undertow's chunked transfer encoding parser. The ChunkReader.state field uses a long value to track both the remaining bytes in a chunk and internal state flags (such as FLAGFINISHED at bit 62 and FLAGREADINGAFTERLAST at bit 58). When a client sends a chunk-size header with a value large enough to set these high-order bits (e.g., 0x4000000000000000 or 0x0400000000000000), the parser incorrectly interprets the chunk or the entire request as completed. Because this logic error occurs during the parsing of the chunk header itself, default entity size limits (like max-post-size) are not triggered, as no body bytes have been consumed yet. Concrete Impact: An attacker can use this flaw to perform HTTP Request Smuggling. Specifically, they can: Force the server to treat part of a single TCP stream as a new, independent request.

Bypass security filters or routing rules implemented at the proxy/gateway level.

Cause request desynchronization where one user's request is prepended to another user's subsequent request on the same connection.

A vulnerability was identified in Undertow (as used in Wildfly) where the server prematurely parses and stores multipart/form-data content to the disk when receiving an HTTP GET request, provided the underlying application (e.g., JSF) invokes parameter-parsing methods like getParameterMap().

There exists a security vulnerability in Undertow that can cause remote DoS attacks. Servlets using method that calls HttpServletRequestImpl.getParameterNames() will cause OutOfMemoryError when the client sends a request with huge parameter names. This vulnerability can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack.