Live › vulnerability › CVE-2026-91920
A crafted 15-digit chunk size in HTTP chunked transfer encoding bypasses the size check in Undertow's ChunkReader, overflowing into internal state flags. The server can end a request body early and treat the leftover bytes as a separate smuggled request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 02:28 UTC. All times on this page are UTC.
Teams running Java applications on the Undertow web server, typically through WildFly or JBoss EAP, that accept HTTP requests from untrusted clients. The risk is highest where a front-end proxy and Undertow both parse requests, since smuggling depends on disagreement between them. Deployments behind no untrusted traffic path, or on a different server, can skip it.
No product ranges from the sources yet.
mvn dependency:tree or by looking for undertow-core in the build file.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.
This page as .md · .json · in your agent: get_signal("CVE-2026-91920")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.