{"id":"CVE-2026-91920","title":"Undertow: undertow: chunkreader message length permits chunk-size overflow","summary":"A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is s…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-444"],"vendor":"Red Hat","product":"undertow-servlet","affected":["undertow-servlet (all versions)","pki-core:10.6/resteasy","pki-deps:10.6/resteasy","resteasy","undertow-servlet","jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)","jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)","jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)","undertow-servlet (all versions)","undertow-servlet (all versions)","undertow-servlet","undertow-servlet (all versions)"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-02T20:40:10.909550Z"},"published":"2026-10-30","updated":"2026-11-03","sourceUpdated":"2026-11-03T17:47:36.306Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91920","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91920"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528758","label":"RHBZ#2528758"}],"tags":["cve.org"],"epss":0.00235,"epssPercentile":0.14608,"ingestedAt":"2026-11-05T20:33:06.332Z","slug":"CVE-2026-91920","body":"## Overview\n\nA flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.\n\n## Affected\n\n- `undertow-servlet (all versions)`\n- `pki-core:10.6/resteasy`\n- `pki-deps:10.6/resteasy`\n- `resteasy`\n- `undertow-servlet`\n- `jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)`\n- `jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)`\n- `jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)`\n- `undertow-servlet (all versions)`\n- `undertow-servlet (all versions)`\n- `undertow-servlet`\n- `undertow-servlet (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}