EUVD-2026-56227
GHSA-x562-68w7-4xvf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Standard HTTP chunked request requires no credentials and no special conditions; impact is limited to integrity (request smuggling/security bypass) with no confidentiality or availability consequence.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
AnalysisAI
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. No confirmed active exploitation or public proof-of-concept has been identified at time of analysis; the CVSS 5.3 Medium score reflects limited direct impact, though real-world risk in proxy-fronted architectures is meaningfully higher than the score alone suggests.
Technical ContextAI
Undertow is a high-performance, non-blocking Java HTTP server library at the core of Red Hat's JBoss EAP and WildFly application servers. CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request Smuggling) identifies the root cause class: the ChunkReader parser uses a single internal integer variable to store both the remaining chunk byte count and internal state flags. When a client sends a chunk-size value large enough that its numeric representation overlaps with the bits used for state signaling, the parser incorrectly concludes the current request is complete. A trailing payload is then interpreted as a new, independent HTTP request, desynchronizing request boundaries between the front-end proxy and the Undertow backend. CPE data confirms that this flaw is present across multiple Red Hat product lines that bundle Undertow: cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_7, cpe:2.3:a:red_hat:red_hat_enterprise_linux_8/9/10, cpe:2.3:a:red_hat:red_hat_data_grid_8, cpe:2.3:a:red_hat:red_hat_fuse_7, and related Camel/Hawtio/SSO products.
RemediationAI
The primary fix is to apply Red Hat-issued patches for the specific product stream in use (JBoss EAP 7/8, RHEL 8/9/10, SSO 7, Data Grid 8, etc.) as they become available. No exact patched version numbers are provided in the source intelligence - consult https://access.redhat.com/security/cve/CVE-2026-14180 and https://bugzilla.redhat.com/show_bug.cgi?id=2494771 directly for current fix availability per product. As compensating controls pending patching, consider enabling strict HTTP request normalization on any reverse proxy in front of Undertow: for nginx, enabling 'proxy_request_buffering on' causes the proxy to fully buffer and re-serialize requests before forwarding, eliminating smuggling ambiguity at the cost of increased memory use and loss of streaming request support. For Apache httpd, 'MergeTrailers off' and rejection of requests with ambiguous Transfer-Encoding headers reduce the attack surface. Disabling HTTP/1.1 keep-alive connections on the frontend proxy eliminates the channel through which smuggled requests persist, but significantly degrades throughput. None of these controls substitute for patching.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today