CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow

Description

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector

Network

Attack complexity

Low

Privileges required

None

Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected products and versions