Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | affected | — |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | affected | — |
| Red Hat | Red Hat Data Grid 8 | affected | — |
| Red Hat | Red Hat Enterprise Linux 10 | affected | — |
| Red Hat | Red Hat Enterprise Linux 8 | affected | — |
| Red Hat | Red Hat Enterprise Linux 8 | affected | — |
| Red Hat | Red Hat Enterprise Linux 9 | affected | — |
| Red Hat | Red Hat Fuse 7 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | affected | — |
| Red Hat | Red Hat Single Sign-On 7 | affected | — |
No data.
No data.
No data.
Project Subscriptions
No advisories yet.
Solution
No solution given by the vendor.
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Tue, 11 Aug 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 11 Aug 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls. | |
| Title | Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap | |
| First Time appeared |
Redhat
Redhat apache Camel Hawtio Redhat camel Spring Boot Redhat enterprise Linux Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-444 | |
| CPEs | cpe:/a:redhat:apache_camel_hawtio:4 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:jbosseapxp cpe:/a:redhat:red_hat_single_sign_on:7 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat apache Camel Hawtio Redhat camel Spring Boot Redhat enterprise Linux Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-08-11T18:29:31.703Z
Reserved: 2026-06-30T07:59:30.806Z
Link: CVE-2026-14180
Vulnrichment
Updated: 2026-08-11T18:29:26.403Z
NVD
Status : Received
Published: 2026-08-11T16:17:28.923
Modified: 2026-08-11T19:17:19.960
Link: CVE-2026-14180
Redhat
No data.
OpenCVE Enrichment
No data.