Hi,

The following vulnerabilities were published for undertow.

Unfortunately the only references are at time of this writing the Red
Hat bugzilla entries, can yu have a closer look at all 4 CVEs? Maybe
we need split up of the bug if necessary.

CVE-2026-14180[0]:
| A flaw was found in the ChunkReader component of the Undertow HTTP
| server, which is used by WildFly and JBoss EAP to handle chunked
| transfer encoding. The issue occurs because the parser uses a single
| internal variable to store both the remaining chunk size and state
| flags. By sending a specially crafted request with an extremely
| large chunk size, an attacker can cause these values to overlap,
| tricking the parser into thinking a request has finished
| prematurely. This can allow a second, "smuggled" request to be
| processed out of sync, potentially bypassing security controls.


CVE-2026-15554[1]:
| the Undertow AJP listener honours forged ssl_cert and is_ssl AJP
| attributes without requiring any shared-secret authentication. This
| enables an unauthenticated attacker with direct TCP access to port
| 8009 to bypass CLIENT-CERT authentication by injecting a forged
| X.509 certificate via the AJP protocol.


CVE-2026-15561[2]:
| A flaw was found in EAP's undertow http/1.1 chunked-transfer
| decoder. missing limits on size and count would allow an attacker to
| use an unauthenticated connection to drive the JVM to an OutOfMemory
| error, stopping all deployments on the listener, and achieving
| Denial of Service.


CVE-2026-15565[3]:
| A flaw was found in Undertow. A remote attacker can cause Out of
| Memory on websockets endpoint without authentication on any
| @ServerEndpoint class that has any @OnMessage method. This allows an
| attacker to cause Denial of Service attack without authentication
| and using only a standard WebSocket handshake.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-14180
https://www.cve.org/CVERecord?id=CVE-2026-14180
[1] https://security-tracker.debian.org/tracker/CVE-2026-15554
https://www.cve.org/CVERecord?id=CVE-2026-15554
[2] https://security-tracker.debian.org/tracker/CVE-2026-15561
https://www.cve.org/CVERecord?id=CVE-2026-15561
[3] https://security-tracker.debian.org/tracker/CVE-2026-15565
https://www.cve.org/CVERecord?id=CVE-2026-15565

Regards,
Salvatore