{"id":"CVE-2026-91920","aliases":[],"cve":{"records":[{"id":"CVE-2026-91920","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-15T10:20:33.140Z","published":"2026-10-30T01:16:53.416Z","modified":"2026-10-30T01:16:53.416Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-10-30T01:16:53.416Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91920","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528758","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-444","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","source":"redhat"}],"applicability":[],"prioritization":[]},"title":"Undertow: undertow: chunkreader message length permits chunk-size overflow","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.","score":6.5,"severity":"medium","published":"2026-10-30T01:16:53.416Z","modified":"2026-10-30T01:16:53.416Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat build of Apache Camel for Spring Boot 4","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:camel_spring_boot:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/o:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/o:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/o:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat Fuse 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_fuse:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform Expansion Pack","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:jbosseapxp"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"},{"vendor":"Red Hat","name":"Red Hat Single Sign-On 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"}],"remediation":[],"references":["https://access.redhat.com/security/cve/CVE-2026-91920","https://bugzilla.redhat.com/show_bug.cgi?id=2528758"],"sources":[{"name":"CVE","id":"CVE-2026-91920","modified":"2026-10-30T01:16:53.416Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T02:46:45.683Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T03:05:34.031Z","attemptedAt":"2026-10-30T03:05:34.031Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T03:05:34.172Z","attemptedAt":"2026-10-30T03:05:34.172Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T03:05:36.112Z","attemptedAt":"2026-10-30T03:05:36.112Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T03:05:33.667Z","attemptedAt":"2026-10-30T03:05:33.667Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-91920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91920","modified":"2026-10-30T02:17:10.267","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-10-30T03:05:34.031Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113473","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113473","modified":"Oct 30, 2026, 1:16:53 AM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","checkedAt":"2026-10-30T03:05:36.112Z"}],"aiSummary":{"text":"A flaw in Undertow's ChunkReader component allows a crafted 15-digit chunk size to bypass the limit and overflow, potentially causing the server to terminate a request body prematurely and interpret remaining data as a separate request. The issue affects Red Hat products, including Red Hat build of Apache Camel for Spring Boot 4 and Red Hat JBoss Enterprise Application Platform 7. The impact is related to HTTP Request Smuggling.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:18:36.102Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-91920"}]}}