CVE-2026-14180

Name of the Vulnerable Software and Affected Versions Undertow HTTP server (affected versions not specified) WildFly (affected versions not specified) JBoss EAP (affected versions not specified)

Description A flaw exists in the ChunkReader component of the Undertow HTTP server, which is utilized by WildFly and JBoss EAP for handling chunked transfer encoding. The issue stems from the parser using a single internal variable to store both state flags and the remaining chunk size. An attacker can send a specially crafted request with an excessively large chunk size to cause these values to overlap, misleading the parser into believing a request has ended prematurely. This condition enables HTTP request smuggling, where a second request is processed out of sync, potentially bypassing security controls.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.