CVE-2026-14180 Red Hat CVE debrief

Who should care

Defenders responsible for the security of Undertow HTTP server configurations, particularly those using WildFly and JBoss EAP, should assess their exposure and verify the security of their configurations.

Why it matters

The flaw in the ChunkReader component of the Undertow HTTP server allows an attacker to bypass security controls, potentially leading to exploitation. Defenders should prioritize verifying exposure and assessing the security of their configurations.

• Potential bypass of security controls
• Possible exploitation by attackers
• Need for verification of exposure
• Priority for updating configurations

Technical summary

The ChunkReader component of the Undertow HTTP server, used by WildFly and JBoss EAP, has a flaw that allows an attacker to bypass security controls by sending a specially crafted request with an extremely large chunk size. The parser uses a single internal variable to store both the remaining chunk size and state flags, which can overlap and trick the parser into thinking a request has finished prematurely.

Defensive priority

Defenders should prioritize verifying exposure and assessing the security of their Undertow HTTP server configurations, particularly those using WildFly and JBoss EAP. They should review and update their configurations to prevent exploitation.

Recommended defensive actions

• Verify exposure by reviewing Undertow HTTP server configurations
• Assess the security of WildFly and JBoss EAP configurations
• Update configurations to prevent exploitation
• Monitor for suspicious requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail provide information on the flaw in the ChunkReader component of the Undertow HTTP server. Redhat has provided references to their errata and security pages for further information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.