CyberRota Analysis
AI-GeneratedA vulnerability exists in the ChunkReader component of the Undertow HTTP server, utilized by WildFly and JBoss EAP, due to improper handling of chunked transfer encoding. An attacker can exploit this flaw by sending a specially crafted request with an excessively large chunk size, leading to potential request smuggling that may bypass security controls. Organizations using these servers should prioritize addressing this vulnerability to mitigate the risk of unauthorized access or data leakage.
Original NVD Description
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.