CVE-2026-81624
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
75/100
Published: 2026-08-31
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
Weakness Classification (1)
References & Advisories (2)
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT