Executive brief
Undertow is a web server component used in Java applications to handle HTTP and WebSocket connections. An attacker can send specially crafted WebSocket messages to trigger excessive memory consumption, causing the application to become unresponsive or crash—a denial of service attack that disrupts service availability for legitimate users.
Technical details
The vulnerability exists in Undertow's PerMessageDeflateFunction.largerBuffer() method, which handles WebSocket permessage-deflate compression negotiation. When processing specially crafted WebSocket messages, the method uses exponential buffer doubling that can consume excessive memory without proper bounds checking. An unauthenticated remote attacker can trigger this condition by sending malicious permessage-deflate WebSocket frames over the network, leading to uncontrolled memory allocation and eventual denial of service. Patches are expected from the vendor.
Affected products
- Red Hat Undertow
Timeline
- 2026-08-27: disclosed