Description

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T09:17:12.963Z",
  "pubdate": "2026-08-11T09:17:12.963Z",
  "executiveSummary": "A denial of service vulnerability exists within the HTTP/1.1 chunked-transfer decoder of EAP's undertow component.\nThe flaw stems from the absence of strict size and count limitations when processing chunked transfer-encoded requests, allowing an unauthenticated remote attacker to exhaust JVM heap memory.\nSuccessful exploitation forces an OutOfMemory error, resulting in the termination of all deployments on the targeted listener and an effective application-wide denial of service.\nThe attack requires network access to an exposed HTTP listener but does not require authentication or prior privileges, making it a severe availability risk for affected deployments.\nMitigation requires applying vendor-supplied patches or updates to the undertow component to enforce appropriate constraints on chunked transfer-encoding processing.",
  "technicalDetails": "The vulnerability resides in the HTTP/1.1 chunked-transfer decoder of the EAP undertow component.\nThe root cause of the flaw is the missing enforcement of size and count boundaries during the parsing and handling of chunked transfer-encoded payloads.\nAn unauthenticated attacker can initiate a network connection to the HTTP/1.1 listener and send a continuous, unbounded stream of chunks or exceptionally large chunk structures.\nBecause the parser lacks defensive constraints regarding the aggregate size or the total number of incoming chunks, the JVM allocates excessive heap memory to buffer or process the incoming payload.\nAs the payload is processed, heap memory consumption escalates rapidly until the JVM exhausts available memory resources.\nThis resource exhaustion triggers a fatal OutOfMemory error within the runtime environment.\nThe crash of the JVM heap directly impacts the affected listener, causing a complete cessation of all active deployments and services hosted on that listener, culminating in a localized denial of service condition.\nThe attack is network-exploitable, requires no authentication, and demands no privileged access to the underlying operating system or application tier, lowering the barrier to exploitation."
}