Bug 2494771 (CVE-2026-14180)

Summary: CVE-2026-14180 undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abrianik, anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, fmariani, ggrzybek, gmalinko, istudens, ivassile, iweiss, janstey, jraez, jwon, mcarlett, mosmerov, mposolda, msvehla, nwallace, parichar, pberan, pdelbell, pesilva, pjindal, pmackay, rhel-process-autobot, rmartinc, rstancel, rstepani, security-response-team, ssilvert, sthorger, tasato, tcunning, thjenkin, vdosoudi, vmuzikar, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-30 07:04:17 UTC 
A request desynchronization vulnerability exists in Undertow's chunked transfer encoding parser. The ChunkReader.state field uses a long value to track both the remaining bytes in a chunk and internal state flags (such as FLAG_FINISHED at bit 62 and FLAG_READING_AFTER_LAST at bit 58).
When a client sends a chunk-size header with a value large enough to set these high-order bits (e.g., 0x4000000000000000 or 0x0400000000000000), the parser incorrectly interprets the chunk or the entire request as completed. Because this logic error occurs during the parsing of the chunk header itself, default entity size limits (like max-post-size) are not triggered, as no body bytes have been consumed yet.
Concrete Impact:
An attacker can use this flaw to perform HTTP Request Smuggling. Specifically, they can:
Force the server to treat part of a single TCP stream as a new, independent request.

Bypass security filters or routing rules implemented at the proxy/gateway level.

Cause request desynchronization where one user's request is prepended to another user's subsequent request on the same connection.