A request desynchronization vulnerability exists in Undertow's chunked transfer encoding parser. The ChunkReader.state field uses a long value to track both the remaining bytes in a chunk and internal state flags (such as FLAG_FINISHED at bit 62 and FLAG_READING_AFTER_LAST at bit 58).
When a client sends a chunk-size header with a value large enough to set these high-order bits (e.g., 0x4000000000000000 or 0x0400000000000000), the parser incorrectly interprets the chunk or the entire request as completed. Because this logic error occurs during the parsing of the chunk header itself, default entity size limits (like max-post-size) are not triggered, as no body bytes have been consumed yet.
Concrete Impact:
An attacker can use this flaw to perform HTTP Request Smuggling. Specifically, they can:
Force the server to treat part of a single TCP stream as a new, independent request.

Bypass security filters or routing rules implemented at the proxy/gateway level.

Cause request desynchronization where one user's request is prepended to another user's subsequent request on the same connection.