The vulnerability resides in the ChunkReader component of the Undertow HTTP server, which WildFly and JBoss EAP use to process chunked transfer encoding. Because the parser reuses a single variable for both the remaining chunk size and internal state flags, a client can send a request with an extraordinarily large chunk size that causes the two values to overlap. When this occurs the parser incorrectly believes the current request is finished, allowing a second, smuggled request to be processed out of sync. This flaw is classified as CWE‑444 and can enable an attacker to bypass security controls such as authentication or access‑control checks that rely on the integrity of the request stream.

Affected systems include Red Hat Enterprise Linux 8, 9, and 10; Red Hat JBoss Enterprise Application Platform versions 7 and 8, including the Expansion Pack; Red Hat Data Grid 8; Red Hat Fuse 7; Red Hat Single Sign‑On 7; and the Red Hat builds of Apache Camel with HawtIO 4 and Spring Boot 4.

The CVSS score of 5.3 indicates moderate severity. Because the EPSS score is unavailable and the issue is not listed in CISA’s KEV catalog, the likelihood of exploitation by the community remains uncertain, but an attacker with network access to any exposed Undertow‑based service could craft the oversized chunk request to smuggle a second request. The ability to process a second request out of sync could allow unauthorized actions or the bypass of firewall or WAF rules that depend on normal request sequencing.