---
id: CVE-2026-91920
title: 'Undertow: undertow: chunkreader message length permits chunk-size overflow'
summary: >-
  A flaw was found in the ChunkReader component of the Undertow web server,
  which is used to handle chunked transfer encoding in HTTP requests. The issue
  occurs because a security check for the chunk size is performed before the
  value is s…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-444
vendor: Red Hat
product: undertow-servlet
affected:
  - undertow-servlet (all versions)
  - 'pki-core:10.6/resteasy'
  - 'pki-deps:10.6/resteasy'
  - resteasy
  - undertow-servlet
  - jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)
  - undertow-servlet (all versions)
  - undertow-servlet (all versions)
  - undertow-servlet
  - undertow-servlet (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T20:40:10.909550Z'
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T01:46:34.006Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-91920'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-91920'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528758'
    label: RHBZ#2528758
tags:
  - cve.org
epss: 0.00235
epssPercentile: 0.14582
ingestedAt: '2026-11-05T20:33:06.332Z'
---

## Overview

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

## Affected

- `undertow-servlet (all versions)`
- `pki-core:10.6/resteasy`
- `pki-deps:10.6/resteasy`
- `resteasy`
- `undertow-servlet`
- `jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)`
- `jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)`
- `jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)`
- `undertow-servlet (all versions)`
- `undertow-servlet (all versions)`
- `undertow-servlet`
- `undertow-servlet (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.