EUVD-2026-56227
GHSA-x562-68w7-4xvf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Standard HTTP chunked request requires no credentials and no special conditions; impact is limited to integrity (request smuggling/security bypass) with no confidentiality or availability consequence.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
AnalysisAI
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Chunked transfer encoding support must be active on the Undertow server - this is a default-enabled, standard HTTP/1.1 behavior requiring no special configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly identifies network-reachable, unauthenticated exploitation with low complexity, but the integrity impact rating of 'Low' understates what request smuggling can enable in layered architectures. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends an HTTP/1.1 chunked request to a JBoss EAP instance fronted by a WAF or authentication proxy, embedding a second HTTP request in the body using an oversized chunk-size value that triggers the ChunkReader state variable overlap. The front-end proxy, parsing the outer request correctly, applies authentication checks and passes the connection to Undertow; Undertow's desynchronized parser then processes the smuggled inner request as a new, unauthenticated request, potentially reaching an administrative endpoint or authenticated API resource without the proxy's security checks ever being applied. … |
| Remediation | The primary fix is to apply Red Hat-issued patches for the specific product stream in use (JBoss EAP 7/8, RHEL 8/9/10, SSO 7, Data Grid 8, etc.) as they become available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Request Smuggling
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today