Undertow EUVD-2026-113473

Exploitation requires the Undertow listener to process HTTP/1.1 chunked transfer-encoding request bodies (standard behavior) and an attacker-supplied request carrying a crafted 15-digit chunk size that passes the size check before it is shifted. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed and it is remotely reachable against default chunked handling. The key limiting factor is deployment topology: request smuggling produces meaningful impact only where Undertow shares connections with, or sits behind, a front-end proxy/load balancer whose parser disagrees - in a standalone deployment with no connection reuse the effect is largely limited to premature termination of the attacker's own request. The specific downstream impact (auth bypass, routing abuse, cache poisoning) is not described in the available sources.

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but impact is capped at C:N/I:L/A:L - no confidentiality loss, limited integrity (request desync) and limited availability (premature request termination) - yielding 6.5 Medium. This is a classic HTTP request smuggling issue (CWE-444) where a chunk-size bound is checked before a shift, so a crafted 15-digit value overflows into internal state flags. The vuln.today Decision label is 'this_month' (a scheduled-remediation priority, not act_now/emergency), and the CVE is not in CISA KEV. No EPSS score was supplied in the input, and no POC or exploit reference is present, so there is no public exploit identified at time of analysis. The practical risk driver is not raw severity but blast radius: smuggling is only impactful where Undertow sits in a proxy/front-end chain or reuses connections, and its real effect (auth bypass, cache poisoning, request routing abuse) depends on the surrounding architecture, which this data does not describe. Net assessment: a legitimate Medium to prioritize within normal patch cycles, consistent with the 'this_month' label, not a drop-everything emergency. Missing EPSS and the absence of any exploitation evidence are the main data gaps.

An unauthenticated attacker sends a single HTTP/1.1 request to an Undertow endpoint using chunked transfer encoding with a specially crafted 15-digit chunk size that passes the size check before the shift, overflowing into internal state flags so Undertow ends the body early and treats trailing bytes as a second request. Where Undertow shares a connection with or sits behind a front-end proxy, this smuggled request can be routed as another user's traffic, enabling request desynchronization. No public exploit is identified in the provided data, and exploitation requires a parser-disagreement deployment to produce meaningful impact.