Executive brief
Undertow is a lightweight Java web server commonly used in enterprise applications and microservices. A vulnerability allows remote attackers to exhaust server memory through WebSocket connections without requiring any authentication, causing the application to crash or become unavailable. An attacker can trigger this with a standard WebSocket handshake, making it easy to exploit and disruptive to business operations.
Technical details
The vulnerability is a memory exhaustion denial of service flaw in Undertow's WebSocket handling. Any @ServerEndpoint class with an @OnMessage method is vulnerable to an unauthenticated remote attacker who can trigger out-of-memory conditions through WebSocket connections. The flaw requires only a standard WebSocket handshake and no authentication, making it a low-complexity network attack. An attacker can cause the target application to exhaust memory and crash, resulting in service unavailability. Patches are expected from Red Hat for affected Undertow versions.
Affected products
- Red Hat Undertow
Timeline
- 2026-08-11: disclosed