Skip to main content
MEDIUM

CVE-2026-14180

CVSS v3

5.3

MEDIUM

EPSS Score

1.0 %

exploit probability, as of 2026-10-17

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for undertow-core. Watch undertow-core in CVE Watch Free account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • CVE-2026-14180 Red Hat Product Security443 products fixed · 25 known affected

    undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

    undertow-core as a component of Red Hat build of Apache Camel - HawtIO 4 · undertow-core as a component of Red Hat build of Apache Camel for Spring Boot 4 · undertow-core as a component of Red Hat Data Grid 8

  • RHSA-2026:70277 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

  • RHSA-2026:70230 Red Hat Product Security147 products fixed

    Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

  • RHSA-2026:70228 Red Hat Product Security148 products fixed

    Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

  • RHSA-2026:70229 Red Hat Product Security148 products fixed

    Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Full record on NVD

Description

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
2026-08-11
Last Modified
2026-08-11

Frequently asked questions

What is CVE-2026-14180?

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

Is CVE-2026-14180 actively exploited?

Active exploitation of CVE-2026-14180 has not been confirmed. Its EPSS score was 1.0% on 2026-10-17, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-14180?

CVE-2026-14180 has a CVSS v3 base score of 5.3 (MEDIUM severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Running undertow-core? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · 50 free checks/month · Free API key

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database