A flaw exists in the HTTP/1.1 chunked transfer decoder of EAP’s Undertow web server. The decoder accepts chunked requests without imposing limits on the size or count of chunks, allowing an unauthenticated attacker to send a specially crafted request that consumes excessive memory. The JVM ultimately exhausts heap space, causing an OutOfMemoryError that brings down all deployments listening on the affected socket. This results in a denial of service. The weakness is classified as CWE‑770.

The vulnerability affects Red Hat JBoss Enterprise Application Platform versions 7, 8, and the Expansion Pack. No specific version ranges are listed; any deployment of these products is potentially impacted until a fix is applied.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote, unauthenticated connection to an HTTP listener that accepts chunked requests. An attacker can trigger the denial of service without needing credentials or privileged access.