# CVE-2026-14180: Red Hat Undertow ChunkReader HTTP request smuggling

Source: https://junglewise.ai/threats/cve-2026-14180-red-hat-undertow-chunkreader-http-request-smuggling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14180 · Severity: medium · CVSS 5.3 · Published 2026-08-11

The Undertow HTTP server component, used by WildFly and JBoss EAP to process web traffic, contains a flaw in how it parses chunked transfer encoding. An attacker can craft a malicious HTTP request that causes the parser to misinterpret the end of a request, allowing a second "smuggled" request to bypass security checks. This could enable attackers to circumvent access controls, inject content, or compromise application integrity.

Technologies: [Red Hat JBoss EAP](https://junglewise.ai/threats/technologies/jboss-eap), [Red Hat WildFly](https://junglewise.ai/threats/technologies/wildfly). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-14180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14180 being exploited in the wild.

**How severe is CVE-2026-14180?** Medium severity, with a CVSS score of 5.3, published 11 August 2026.

**Which products and versions are affected?** Red Hat JBoss EAP <UNKNOWN>; Red Hat WildFly <UNKNOWN>.

**Is there a fix for CVE-2026-14180?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14180 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14180?** Check whether you run Red Hat JBoss EAP or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a request smuggling flaw (CWE-444) in the ChunkReader component of Undertow, which parses HTTP chunked transfer encoding. The parser uses a single variable to store both chunk size and state flags, allowing these to overlap when processing specially crafted requests with extremely large chunk sizes. An attacker with network access to the HTTP server can send a malicious chunked request causing the parser to incorrectly mark the request as complete, allowing a second request embedded in the same TCP stream to be processed without proper request boundary validation. This can result in request smuggling attacks that bypass security controls. Patches are expected from Red Hat for affected WildFly and JBoss EAP versions.

## Affected products

- Red Hat Undertow <UNKNOWN>
- Red Hat WildFly <UNKNOWN>
- Red Hat JBoss EAP <UNKNOWN>

## Timeline

- 2026-08-11: disclosed: Vulnerability disclosed publicly

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)

## Related threats

- [Red Hat JBoss EAP platform-mbean RBAC bypass](https://junglewise.ai/threats/cve-2026-19610-a-flaw-was-found-in-the-platform-mbean-component-of-jboss-eap)
- [Wildfly IIOP listener pre-authentication deserialization](https://junglewise.ai/threats/cve-2026-15564-wildfly-s-iiop-listener-may-permit-deserialization-of-input)
- [WildFly authentication bypass in IIOP EJB CSIv2](https://junglewise.ai/threats/cve-2026-114488-a-flaw-was-found-in-wildfly-a-remote-attacker-can-bypass)
- [WildFly path traversal in take-snapshot operation](https://junglewise.ai/threats/cve-2026-84823-a-flaw-was-found-in-wildfly-a-user-with-the-monitor-role-which-is)
- [WildFly and JBoss EAP path traversal in ContentRepositoryImpl](https://junglewise.ai/threats/cve-2026-85634-a-flaw-was-found-in-the-contentrepositoryimpl-copyexplodedcontent)