Skip to content
Sign in
6.5 Medium

CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow

Description

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Single Sign-On 7 Versions not published

Other CVEs of Red Hat build of Apache Camel for Spring Boot 4

The 106 CVEs of Red Hat build of Apache Camel for Spring Boot 4 →
CVE-2026-114370 Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal 3.7 Low CVE-2026-93562 Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling 6.5 Medium CVE-2026-93574 Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing 6.5 Medium CVE-2026-93579 Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough) 6.5 Medium
Track this CVE