Skip to content
OpenAdvisories

Description

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Apache Camel for Spring Boot 4 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat Fuse 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Single Sign-On 7 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 undertow No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 undertow No fix yet —
Ubuntu 26.04 LTS undertow No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 22.04 LTS undertow No fix yet —
Ubuntu Pro 20.04 LTS undertow No fix yet —
Ubuntu Pro 18.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —

References