A vulnerability in the ChunkReader component of the Undertow web server allows a crafted 15-digit chunk size in HTTP requests to bypass chunk size limits, causing an overflow into internal state flags. This flaw can lead the server to prematurely terminate a request body and interpret remaining data as a separate, smuggled HTTP request. Exploitation requires precise TCP segmentation control. The issue is classified as a moderate severity HTTP request smuggling vulnerability.