CVE-2026-14180 Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
Attackers can smuggle HTTP requests via oversized chunk sizes in Undertow, bypassing security controls in WildFly and JBoss EAP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14180?
CVE-2026-14180 is a medium-severity vulnerability in Red Hat Data Grid 8, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
Weakness: CWE-444
Which versions are affected by CVE-2026-14180?
How do I fix CVE-2026-14180?
Apply the vendor's patch.
Is CVE-2026-14180 being exploited?
There is no known exploitation of CVE-2026-14180 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-14180, GHSA-x562-68w7-4xvf, UBUNTU-CVE-2026-14180.