Executive Summary
A vulnerability in the Undertow web server, used in various Red Hat products, allows an attacker to bypass chunk size limits and potentially smuggle requests. The vulnerability has a CVSS score of 6.5 and is not currently being exploited. Affected products include Red Hat JBoss Enterprise Application Platform, Red Hat Enterprise Linux, and Red Hat Fuse. Technical Analysis
The vulnerability, CVE-2026-91920, is a flaw in the ChunkReader component of the Undertow web server. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request. The vulnerability class is an integer overflow, which allows an attacker to manipulate the chunk size and potentially smuggle requests. How It Gets Exploited
An attacker would need to send a crafted HTTP request with a 15-digit chunk size to the vulnerable Undertow web server. The request would need to be formatted in such a way that the chunk size overflows the internal state flags, allowing the attacker to smuggle a second request. For example, an unauthenticated remote attacker could send a crafted request to the /api endpoint with a chunk size that overflows the internal state flags, potentially allowing them to smuggle a second request. When the flaw is triggered, the server would terminate the request body prematurely and interpret the remaining data as a separate request. The attacker could potentially use this vulnerability to bypass security checks or inject malicious data. Impact Assessment
The vulnerability affects several Red Hat products, including Red Hat JBoss Enterprise Application Platform, Red Hat Enterprise Linux, and Red Hat Fuse. The CVSS score for this vulnerability is 6.5, indicating a moderate level of severity. An attacker could potentially use this vulnerability to smuggle requests, bypass security checks, or inject malicious data. The blast radius of this vulnerability is moderate, as it could potentially be used to compromise the security of affected systems. Recommended Actions
To mitigate this vulnerability, users should update their affected Red Hat products to the latest versions. Specifically, update Red Hat JBoss Enterprise Application Platform to version 7 or later, Red Hat Enterprise Linux 8 to version 8.8 or later, and Red Hat Fuse 7 to version 7.11 or later. Additionally, users should implement security measures such as input validation and request sanitization to prevent similar attacks. Sources
National Vulnerability Database (NVD)