CVE-2026-91920: Undertow: undertow: chunkreader message length permits chunk-size overflow

Vulnerability summary

CVE-2026-91920 is a medium (CVSS 6.5) vulnerability in undertow. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.5% of scored vulnerabilities.

Timeline

1. 30-10-2026
   PublishedVulnerability first disclosed.
2. 03-11-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

• CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.