--- id: CVE-2026-14180 title: >- A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding summary: >- A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the … severity: medium cvss: 5.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N' cwe: - CWE-444 vendor: Red Hat product: eap8-activemq-artemis affected: - eap8-activemq-artemis (all versions) - eap8-apache-cxf (all versions) - eap8-artemis-wildfly-integration (all versions) - eap8-bouncycastle (all versions) - eap8-cryptacular (all versions) - eap8-eap-product-conf-parent (all versions) - eap8-hibernate (all versions) - eap8-httpcomponents-asyncclient (all versions) - eap8-ironjacamar (all versions) - eap8-jackson-annotations (all versions) - eap8-jackson-core (all versions) - eap8-jackson-databind (all versions) - eap8-jackson-dataformats-text (all versions) - eap8-jackson-jaxrs-providers (all versions) - eap8-jackson-modules-base (all versions) - eap8-jackson-modules-java8 (all versions) - eap8-jakarta-xml-bind-api (all versions) - eap8-jaxb (all versions) - eap8-jaxbintros (all versions) - eap8-jboss-logging (all versions) - eap8-jboss-remoting (all versions) - eap8-jbossws-api (all versions) - eap8-jbossws-common-tools (all versions) - eap8-jbossws-cxf (all versions) - eap8-jbossws-jaxws-undertow-httpspi (all versions) - eap8-jbossws-spi (all versions) - eap8-jsf-impl (all versions) - eap8-log4j (all versions) - eap8-neethi (all versions) - eap8-netty (all versions) - eap8-netty-transport-native-epoll (all versions) - eap8-nimbus-jose-jwt (all versions) - eap8-parsson (all versions) - eap8-saaj-impl (all versions) - eap8-slf4j (all versions) - eap8-undertow (all versions) - eap8-wildfly (all versions) - eap8-wildfly-elytron (all versions) - eap8-wildfly-javadocs (all versions) - eap8-ws-commons-XmlSchema (all versions) - eap8-xml-security (all versions) - eap8-activemq-artemis (all versions) - eap8-apache-cxf (all versions) - eap8-artemis-wildfly-integration (all versions) - eap8-bouncycastle (all versions) - eap8-cryptacular (all versions) - eap8-eap-product-conf-parent (all versions) - eap8-hibernate (all versions) - eap8-httpcomponents-asyncclient (all versions) - eap8-ironjacamar (all versions) published: '2026-08-11' updated: '2026-09-22' sourceUpdated: '2026-09-22T16:17:37.930' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14180' references: - url: 'https://access.redhat.com/errata/RHSA-2026:70228' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:70229' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:70230' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:70277' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-14180' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2494771' label: secalert@redhat.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14180.json - url: 'https://www.cve.org/CVERecord?id=CVE-2026-14180' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14180' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.01034 epssPercentile: 0.62355 ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-08-11T18:29:20.646309Z' ingestedAt: '2026-09-22T16:06:00.483Z' patched: - jboss_eap_8_1_for_rhel 10 - jboss_eap_8_1_for_rhel 8 - jboss_eap_8_1_for_rhel 9 --- ## Overview A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:70230** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 10 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70230) - **RHSA-2026:70228** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70228) - **RHSA-2026:70229** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70229) - **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Data Grid 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · no fix planned: Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Data Grid 8, Red Hat Enterprise Linux 10, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14180.json)