Undertow: undertow: chunkreader message length permits chunk-size overflow (Red Hat Red Hat build of Apache Camel for Spring Boot 4)

CVE-2026-91920
MEDIUM 6.5

En bref

Source
NVD
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Awaiting Analysis

Description

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

Faiblesses (CWE)

  • CWE-444 — Dissimulation de requête ou de réponse HTTP

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lredhat
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LNVD · secalert@redhat.com (Primary)

Références européennes

Produits affectés

ProduitVersions
Red Hat · Red Hat build of Apache Camel for Spring Boot 4
Red Hat · Red Hat Enterprise Linux 8
Red Hat · Red Hat Enterprise Linux 8
Red Hat · Red Hat Enterprise Linux 9
Red Hat · Red Hat Fuse 7
Red Hat · Red Hat JBoss Enterprise Application Platform 7
Red Hat · Red Hat JBoss Enterprise Application Platform 7
Red Hat · Red Hat JBoss Enterprise Application Platform 7
Red Hat · Red Hat JBoss Enterprise Application Platform 7
Red Hat · Red Hat JBoss Enterprise Application Platform 8
Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat · Red Hat Single Sign-On 7

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD