CVE-2026-14180
Received Received - Intake

Chunked Transfer Encoding Parser Bypass in Undertow

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Red Hat, Inc.

Description
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-14180
EUVD
EUVD-2026-56227

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat undertow From 3.0.0 (inc)
redhat undertow *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Undertow HTTP server's ChunkReader component, which handles chunked transfer encoding. The parser uses a single variable to store both the remaining chunk size and state flags. An attacker can send a request with an extremely large chunk size, causing these values to overlap. This tricks the parser into thinking a request has finished prematurely, allowing a second smuggled request to be processed out of sync and bypass security controls.

Detection Guidance

Detecting this vulnerability requires monitoring for HTTP request smuggling attempts, particularly those involving oversized chunk sizes. Inspect network traffic for malformed HTTP requests with chunk-size headers exceeding normal limits (e.g., values with high-order bits set). Use tools like Wireshark or tcpdump to capture and analyze HTTP traffic for anomalies in chunked transfer encoding.

Impact Analysis

Exploitation could allow HTTP request smuggling, where an attacker sends a specially crafted request to bypass security filters or routing rules. This might lead to request desynchronization, causing one user's request to be prepended to another's. It requires a frontend proxy to forward oversized chunk-size values, enabling attacks like session hijacking or unauthorized access to sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches by bypassing security controls, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected systems may face compliance risks due to insufficient protection against request smuggling attacks.

Mitigation Strategies

Immediate mitigation involves updating Undertow to the latest patched version or applying vendor-supplied fixes for WildFly and JBoss EAP. If updates are unavailable, configure frontend proxies to enforce strict chunk-size validation and reject oversized or malformed chunk headers. Disable chunked transfer encoding if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart