CVE-2026-14180

The CVSS 5.3 rating for this chunked-encoding smuggling vulnerability fundamentally mismeasures the threat. The score treats this as a one-off parsing error when the real issue is architectural: the ChunkReader parser uses a single variable to hold two semantically distinct pieces of state — remaining bytes and flags — creating a condition where a large chunk size can overflow into flag bits. When this happens, the parser doesn't fail; it silently misreads its own internal state and proceeds to process a second request as if it were part of the first. That's a design-class flaw, not a logic error, and it's the kind of vulnerability that conventional fuzzing often misses because it depends on specific numeric relationships between inputs and state variables. What makes this CVE distinctive — and what the CVSS doesn't capture — is that Undertow isn't a proxy front-ending something more important. In WildFly and JBoss EAP deployments, Undertow IS the security boundary. When ChunkReader desynchronizes, security controls within Undertow become blind to their own inputs: authentication modules evaluate the smuggled second request as if it were a first-party call, rate limiters count it against the wrong session, and input validation schemas receive data in a context they never expected. That's not a bypass where an attacker reaches past a guard — it's the guard being fed corrupted intelligence about what it's actually inspecting. The historical pattern is concerning: TE/CL smuggling, HPACK state machine bugs, and now ChunkReader share the same root cause — developers treating parser state as implementation detail rather than a security surface. Each patch addresses one expression of the problem without eliminating the underlying assumption. The next time a developer reaches for the same optimization in WebSocket framing or HTTP/2 continuation frames, they'll face the same tradeoff, and the same cultural precedent will make the bit-packing choice feel justified. Practical steps: First, prioritize this patch despite the medium rating — the downstream impact on authentication and input validation within Undertow itself is the real exposure. Second, audit other Undertow parsing components (WebSocket, SPDY, HTTP/2) for the same shared-variable pattern. Third, treat this not as a one-off fix but as evidence that your parsing infrastructure needs explicit guidelines prohibiting bit-packing of semantic state in boundary-detection code. The CVSS 5.3 tells you to handle this eventually; the architectural context tells you it warrants urgent architectural review.

Reviewed through automated stages and approved by a human before publication.