Quick answers
- Is CVE-2026-14180 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14180 being exploited in the wild.
- How severe is CVE-2026-14180?
- Medium severity, with a CVSS score of 5.3, published 11 August 2026.
- Which products and versions are affected?
- Red Hat JBoss EAP <UNKNOWN>; Red Hat WildFly <UNKNOWN>.
- Is there a fix for CVE-2026-14180?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14180 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-14180?
- Check whether you run Red Hat JBoss EAP or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a request smuggling flaw (CWE-444) in the ChunkReader component of Undertow, which parses HTTP chunked transfer encoding. The parser uses a single variable to store both chunk size and state flags, allowing these to overlap when processing specially crafted requests with extremely large chunk sizes. An attacker with network access to the HTTP server can send a malicious chunked request causing the parser to incorrectly mark the request as complete, allowing a second request embedded in the same TCP stream to be processed without proper request boundary validation. This can result in request smuggling attacks that bypass security controls. Patches are expected from Red Hat for affected WildFly and JBoss EAP versions.
Affected products
- Red Hat Undertow <UNKNOWN>
- Red Hat WildFly <UNKNOWN>
- Red Hat JBoss EAP <UNKNOWN>
Timeline
- 2026-08-11: disclosed: Vulnerability disclosed publicly