Executive brief
Undertow is a high-performance web server embedded in JBoss EAP and WildFly, used to handle web traffic for enterprise Java applications. A vulnerability in WebSocket connection handling allows remote attackers to send unlimited data or maintain connections indefinitely, exhausting server memory and crashing the service without requiring authentication or credentials.
Technical details
The vulnerability exists in Undertow's WebSocket connection handler, which fails to enforce configuration limits on message buffer sizes and session timeouts—these limits default to unlimited. An unauthenticated remote attacker can exploit this by opening WebSocket connections and sending large amounts of data or maintaining idle connections indefinitely, consuming memory and other server resources until the server runs out of resources and crashes (denial of service). The attack is network-accessible and requires no authentication or user interaction. Patches are available from Red Hat for affected versions of JBoss EAP and WildFly.
Affected products
- JBoss Enterprise Application Platform <UNKNOWN>
- Red Hat WildFly <UNKNOWN>
- Red Hat Undertow <UNKNOWN>
Timeline
- 2026-08-31: disclosed: Published on NVD