CVE-2026-91920 in Undertow
Summary
by MITRE • 10/30/2026
A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in the Undertow web server's ChunkReader component represents a critical logic error within the HTTP/1.1 chunked transfer encoding parser. Chunked transfer encoding is a mechanism defined by RFC 7230 that allows data to be sent in multiple parts or chunks, each preceded by its size in hexadecimal format. This method is commonly used when the total content length is unknown at the time of transmission, such as during dynamic web page generation or streaming responses. The specific flaw resides in the sequence of operations performed when parsing these chunk headers. Specifically, Undertow performs a security check to validate that the declared chunk size does not exceed an internal maximum limit before applying necessary bit-shifting operations required for correct integer arithmetic on larger values. This ordering creates a race condition-like logic gap where oversized inputs can evade immediate detection mechanisms designed to prevent buffer overflows or excessive memory allocation.
The technical core of this vulnerability lies in how the 15-digit hexadecimal chunk size is processed. When an attacker submits a crafted HTTP request with a chunk header specifying a value that appears valid under pre-shift validation but results in an overflow after bit-shifting, the internal state flags governing the connection's parsing logic are corrupted. This integer overflow allows the parser to misinterpret the boundary between the current request body and subsequent data streams. Instead of treating the remaining bytes as part of the original malformed chunk or terminating the connection due to a protocol error, the server incorrectly resets its parsing context. Consequently, it begins interpreting the residual data in the TCP stream as the start of a new HTTP request. This behavior effectively enables HTTP Request Smuggling, specifically CL.TE (Content-Length Transfer-Encoding) or TE.CL variants depending on how upstream proxies handle the malformed input.
The operational impact of this vulnerability is severe, primarily facilitating unauthorized access to backend services and bypassing security controls deployed at network perimeters. By smuggling requests into an internal application that may have different parsing rules than the frontend server, attackers can manipulate request routing, steal session cookies, or perform cross-site scripting attacks against other users whose sessions are processed by the smuggled request. Furthermore, because the vulnerability allows for premature termination of legitimate request bodies, it can lead to denial-of-service conditions where valid user inputs are dropped or corrupted before reaching the application logic. This undermines data integrity and availability, posing significant risks in environments relying on Undertow as a reverse proxy or primary web server handling sensitive transactions.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The most effective solution is to apply vendor-provided patches that correct the order of validation operations within the ChunkReader component, ensuring that size limits are enforced after all arithmetic transformations have been completed. Organizations should also implement strict input validation at the network edge using Web Application Firewalls configured to detect anomalous chunk sizes or malformed HTTP headers indicative of smuggling attempts. Additionally, adopting HTTP/2 as a standard protocol can mitigate this risk entirely, as it does not rely on text-based chunked encoding in the same manner and has more robust framing mechanisms that are less susceptible to such parsing ambiguities. Regular auditing of proxy configurations to ensure consistent interpretation of request boundaries is also recommended to prevent exploitation through misconfigured upstream-downstream interactions.
This vulnerability aligns with CWE-190, Integer Overflow or Wraparound, as the core issue stems from improper handling of numeric values leading to unexpected state changes. It also maps directly to MITRE ATT&CK technique T1527, which covers Data Obfuscation and specifically HTTP Request Smuggling techniques used by adversaries to bypass security controls. Understanding these mappings helps in categorizing the risk within broader threat intelligence frameworks and ensures that defensive measures are aligned with industry-standard classification systems for improved detection and response capabilities across enterprise security operations centers.