Executive brief
The Undertow HTTP server component, used by WildFly and JBoss EAP to process web traffic, contains a flaw in how it parses chunked transfer encoding. An attacker can craft a malicious HTTP request that causes the parser to misinterpret the end of a request, allowing a second "smuggled" request to bypass security checks. This could enable attackers to circumvent access controls, inject content, or compromise application integrity.
Technical details
The vulnerability is a request smuggling flaw (CWE-444) in the ChunkReader component of Undertow, which parses HTTP chunked transfer encoding. The parser uses a single variable to store both chunk size and state flags, allowing these to overlap when processing specially crafted requests with extremely large chunk sizes. An attacker with network access to the HTTP server can send a malicious chunked request causing the parser to incorrectly mark the request as complete, allowing a second request embedded in the same TCP stream to be processed without proper request boundary validation. This can result in request smuggling attacks that bypass security controls. Patches are expected from Red Hat for affected WildFly and JBoss EAP versions.
Affected products
- Red Hat Undertow <UNKNOWN>
- Red Hat WildFly <UNKNOWN>
- Red Hat JBoss EAP <UNKNOWN>
Timeline
- 2026-08-11: disclosed: Vulnerability disclosed publicly