boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-14180

Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 — Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0103   62.6     —
AFFECTED
  Product                                                        Versions     Fixed
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:2.40.0-8.redhat_00024.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:4.1.7-1.SP1_redhat_00001.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:2.0.5-1.Final_redhat_00001.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:1.85.0-1.redhat_00001.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:1.2.7-1.redhat_00002.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:801.8.0-1.GA_redhat_00001.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:6.6.54-1.Final_redhat_00001.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:4.1.5-5.redhat_00008.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:3.0.22-1.Final_redhat_00001.1.el10eap
  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10  unspecified  0:2.18.9-1.redhat_00003.1.el10eap
  + 129 more
TIMELINE
  Jun 30  Reserved by redhat
  Aug 11  Published (CNA: redhat)
  Sep 22  PATCH SHIPPED — CVE-2026-14180 (Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10). Fixed in Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:2.40.0-8.redhat_00024.1.el10eap.
CWE-444 · CNA: redhat · CVSS v3.1 · 6 references · NVD status: Awaiting Analysis

Description

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
June 30, 2026ReservedReserved by redhat
August 11, 2026PublishedPublished (CNA: redhat)
September 22, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-14180 (Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10). Fixed in Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:2.40.0-8.redhat_00024.1.el10eap.

Affected

Affected products and packages — 139 rows
VendorProduct / PackageEcosystemVersion introducedFixed
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.40.0-8.redhat_00024.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:4.1.7-1.SP1_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.0.5-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:1.85.0-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:1.2.7-1.redhat_00002.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:801.8.0-1.GA_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:6.6.54-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:4.1.5-5.redhat_00008.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:3.0.22-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.18.9-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.18.9-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.18.9-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.18.9-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.18.9-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.18.9-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.18.9-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:4.0.5-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:4.0.7-4.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.1.0-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:3.6.3-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:5.0.31-1.SP2_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:3.1.0-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.2.0-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:7.4.0-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:3.0.1-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:5.1.0-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:4.0.11-2.SP1_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.25.4-1.redhat_00003.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:3.2.2-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:4.1.136-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:4.1.136-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:9.37.4-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:1.1.9-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:3.0.6-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.0.18-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.3.26-2.SP3_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:8.1.8-9.GA_redhat_00006.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.6.11-1.Final_redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:8.1.1-12.GA_redhat_00048.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:2.3.2-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10——0:3.0.6-1.redhat_00001.1.el10eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.40.0-8.redhat_00024.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:4.1.7-1.SP1_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.0.5-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:1.85.0-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:1.2.7-1.redhat_00002.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:801.8.0-1.GA_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:6.6.54-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:4.1.5-5.redhat_00008.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:3.0.22-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.18.9-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.18.9-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.18.9-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.18.9-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.18.9-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.18.9-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.18.9-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:4.0.5-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:4.0.7-4.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.1.0-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:3.6.3-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:5.0.31-1.SP2_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:3.1.0-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.2.0-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:7.4.0-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:3.0.1-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:5.1.0-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:4.0.11-2.SP1_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.25.4-1.redhat_00003.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:3.2.2-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:4.1.136-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:4.1.136-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:9.37.4-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:1.1.9-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:3.0.6-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.0.18-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.3.26-2.SP3_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:8.1.8-9.GA_redhat_00006.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.6.11-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:8.1.1-12.GA_redhat_00048.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:2.3.2-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8——0:3.0.6-1.redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.40.0-8.redhat_00024.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:4.1.7-1.SP1_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.0.5-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:1.85.0-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:1.2.7-1.redhat_00002.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:801.8.0-1.GA_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:6.6.54-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:4.1.5-5.redhat_00008.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:3.0.22-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.18.9-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.18.9-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.18.9-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.18.9-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.18.9-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.18.9-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.18.9-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:4.0.5-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:4.0.7-4.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.1.0-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:3.6.3-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:5.0.31-1.SP2_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:3.1.0-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.2.0-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:7.4.0-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:3.0.1-1.Final_redhat_00001.1el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:5.1.0-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:4.0.11-2.SP1_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.25.4-1.redhat_00003.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:3.2.2-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:4.1.136-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:4.1.136-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:9.37.4-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:1.1.9-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:3.0.6-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.0.18-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.3.26-2.SP3_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:8.1.8-9.GA_redhat_00006.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.6.11-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:8.1.1-12.GA_redhat_00048.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:2.3.2-1.redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9——0:3.0.6-1.redhat_00001.1.el9eap
Red HatRed Hat build of Apache Camel for Spring Boot 4———
Red HatRed Hat build of Apache Camel - HawtIO 4———
Red HatRed Hat Data Grid 8———
Red HatRed Hat Enterprise Linux 10———
Red HatRed Hat Enterprise Linux 8———
Red HatRed Hat Enterprise Linux 8———
Red HatRed Hat Enterprise Linux 9———
Red HatRed Hat Fuse 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack———
Red HatRed Hat Single Sign-On 7———

Weaknesses

CWE-444

References (6)

Related

Authoritative record: CVE-2026-14180 at cve.org

Vendors: red hat

Weaknesses: CWE-444

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-14180 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.