CVE-2026-14180: Undertow HTTP Server Auth Bypass Flaw

CVE-2026-14180 Overview

CVE-2026-14180 is an HTTP request smuggling vulnerability in the ChunkReader component of the Undertow HTTP server. Undertow ships with Red Hat WildFly and JBoss Enterprise Application Platform (EAP) to process chunked transfer encoding. The parser stores the remaining chunk size and internal state flags in a single variable. An attacker who submits a request with an extremely large chunk size can force these values to overlap, causing the parser to end request processing prematurely. A second smuggled request can then execute out of sync with front-end proxies and bypass upstream security controls. The weakness is categorized as [CWE-444] Inconsistent Interpretation of HTTP Requests.

Critical Impact
Remote, unauthenticated attackers can smuggle HTTP requests through Undertow-based servers, bypassing perimeter security controls and integrity checks enforced by intermediary proxies.

Affected Products

Red Hat JBoss Enterprise Application Platform (EAP)
Red Hat WildFly Application Server
Undertow HTTP server (bundled component)

Discovery Timeline

2026-08-11 - CVE-2026-14180 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-14180

Vulnerability Analysis

The flaw resides in Undertow's ChunkReader, which parses chunked transfer-encoded HTTP request bodies. Chunked encoding delimits each chunk with a hexadecimal size header followed by the raw bytes. The parser tracks two logically distinct properties in one internal variable: the remaining bytes for the current chunk and bit-level state flags that indicate parsing position.

When an attacker specifies a chunk size that approaches the numeric ceiling of that variable, the size value bleeds into the region reserved for state flags. The parser misinterprets these overlapping bits as a terminal state and treats the current request as complete. Bytes that should still belong to the first request are then re-parsed as the start of a new request.

The outcome is a classic HTTP desynchronization scenario, tracked under [CWE-444]. A front-end proxy and the Undertow back-end disagree about where one request ends and the next begins. Attackers exploit this disagreement to poison caches, bypass web application firewall rules, hijack sessions, or reach internal endpoints the proxy would otherwise block.

Root Cause

The root cause is unsafe multiplexing of two distinct concerns onto one integer. There is no bounds check that rejects chunk sizes large enough to collide with the state-flag bits. Combined with the lack of strict validation on chunk-size encoding, the overflow condition becomes reachable from any client that can open a TCP connection to the server.

Attack Vector

Exploitation requires only network access to the HTTP listener. No authentication and no user interaction are needed. The attacker crafts a POST or PUT request with Transfer-Encoding: chunked and supplies a hexadecimal chunk size chosen to overlap with the parser's state flags. Body bytes trailing the malformed chunk header are then interpreted by Undertow as a second, smuggled request. When Undertow sits behind a reverse proxy or load balancer, the smuggled request inherits the trust context of the connection and evades proxy-enforced controls.

No verified public exploit code is available at this time. Refer to the Red Hat CVE-2026-14180 Advisory and Red Hat Bug Report #2494771 for authoritative technical details.

Detection Methods for CVE-2026-14180

Indicators of Compromise

Inbound HTTP requests carrying Transfer-Encoding: chunked alongside abnormally large hexadecimal chunk size declarations (values approaching 0x7FFFFFFF or larger).
Requests containing both Content-Length and Transfer-Encoding headers, which often accompany smuggling attempts.
Undertow access logs showing back-to-back requests on a single keep-alive connection where the proxy logs only one.

Detection Strategies

Compare request counts and URIs between upstream proxy or load balancer logs and Undertow access logs to spot desynchronization.
Deploy web application firewall rules that reject chunked requests with chunk sizes above a sane maximum (for example, greater than 16 MB).
Alert on HTTP 400 spikes from Undertow paired with successful requests logged only at the back end.

Monitoring Recommendations

Enable verbose HTTP parser logging on WildFly and JBoss EAP hosts during triage to capture malformed chunk headers.
Forward proxy and application logs into a centralized analytics platform for correlation across the request path.
Track the volume of chunked requests per client IP and flag anomalies against baseline traffic.

How to Mitigate CVE-2026-14180

Immediate Actions Required

Inventory all deployments of WildFly, JBoss EAP, and any third-party product that embeds Undertow.
Apply the fixed Undertow packages published by Red Hat once available through your subscription channels.
Restrict direct network exposure of Undertow listeners; place them behind hardened reverse proxies that normalize Transfer-Encoding.

Patch Information

Red Hat is coordinating fixes through the advisory tracked at the Red Hat CVE-2026-14180 Advisory. Consult the Red Hat Bug Report #2494771 for package versions, errata identifiers, and product-specific update instructions for JBoss EAP and WildFly releases.

Workarounds

Configure upstream proxies to strip or reject requests containing both Content-Length and Transfer-Encoding headers.
Enforce a strict maximum chunk size at the proxy layer to prevent overlarge chunk declarations from reaching Undertow.
Disable HTTP keep-alive between the proxy and Undertow where feasible, which limits the impact of a desynchronized request pair.

bash

# Example nginx hardening in front of Undertow
http {
    # Reject conflicting framing headers
    map $http_transfer_encoding $bad_framing {
        default 0;
        "~*chunked" 1;
    }

    server {
        listen 443 ssl;
        client_max_body_size 16m;

        if ($bad_framing = 1) {
            set $conflict "${bad_framing}${http_content_length}";
        }
        if ($conflict ~ "^1.+") {
            return 400;
        }

        location / {
            proxy_http_version 1.1;
            proxy_set_header Connection "close";
            proxy_pass http://undertow_backend;
        }
    }
}