original reporting: https://docs.google.com/document/d/1Rf4NtLudECimDNy8F9clUblm6Avx8_yF/edit

DoS — ChunkReader TrailerParser unbounded HeaderMap accumulation (chunked trailer OOM) (JBoss EAP)

JBoss EAP's Undertow HTTP/1.1 chunked-transfer decoder places no size or count limits on the trailer section that follows the terminal `0\r\n` chunk, and trailer bytes are not counted against the configured `max-entity-size` limit; a single unauthenticated TCP connection streaming an arbitrarily large trailer value drives the JVM to `OutOfMemoryError`, taking down all deployments on the listener — this is fully mitigated when a re-framing L7 reverse proxy (nginx, HAProxy in http-mode, ALB) sits in front, but applies to direct-edge and L4/TCP load-balanced deployments.
findings/jboss-eap_68.md