What is the CVSS score of CVE-2026-15565?

CVE-2026-15565 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Undertow are affected by CVE-2026-15565?

Undertow's WebSocket subsystem contains an unauthenticated remote denial-of-service vulnerability (CVE-2026-15565) that allows attackers to trigger unbounded memory exhaustion and crash any web…. A patch is available.

How to fix or mitigate CVE-2026-15565?

Within 24 hours: audit production inventory to identify all applications using Undertow with @ServerEndpoint WebSocket handlers and document which are internet-facing. Within 7 days: implement WAF or reverse-proxy rate limiting on WebSocket upgrade requests to limit concurrent connections per source IP; disable WebSocket functionality entirely if not actively used by business operations; apply per-message size and per-connection memory limits at the application layer. Within 30 days: establish monitoring for Undertow security advisories; evaluate migration to alternative application servers or patched Undertow versions when released; implement network segmentation to restrict WebSocket-exposed services from critical systems.

Undertow CVE-2026-15565

EUVD-2026-55988 HIGH

Classic Buffer Overflow (CWE-120)

2026-08-11 secalert@redhat.com

GHSA-356w-cx4r-75hv

Buffer Overflow Denial Of Service

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, zero-authentication, low-complexity DoS with no confidentiality or integrity impact; scope unchanged as OOM is confined to the vulnerable JVM process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:36 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

HIGH 7.5

DescriptionCVE.org

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

AnalysisAI

Unauthenticated remote memory exhaustion in Undertow's WebSocket subsystem enables denial of service against any deployed application exposing a Jakarta @ServerEndpoint with an @OnMessage handler. An attacker needs only a standard WebSocket handshake - no credentials, no special tooling - to trigger unbounded Out of Memory conditions on the server. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-prerequisite attack vector (CVSS AV:N/AC:L/PR:N/UI:N) makes exploitation trivially automatable against any reachable Undertow instance.

Technical ContextAI

Undertow is Red Hat's high-performance Java NIO-based HTTP server, serving as the default embedded web server for WildFly, JBoss EAP, and Quarkus. It implements the Jakarta WebSocket specification (JSR-356), including server-side endpoint lifecycle management. The vulnerability resides in the WebSocket message handling path: when a remote client connects to any endpoint class annotated with @ServerEndpoint that declares an @OnMessage method, Undertow fails to bound or throttle memory allocated during message processing. The assigned CWE-120 ('Buffer Copy without Checking Size of Input') indicates the root cause is an unchecked size constraint on inbound WebSocket message data, which translates at runtime into unbounded heap allocation and eventual JVM Out of Memory error. The mismatch between CWE-120 (classic buffer overflow) and the OOM description suggests the flaw is in buffer sizing logic rather than a classic native stack overflow - the WebSocket frame or message buffer grows without an enforced ceiling, exhausting the JVM heap.

Affected ProductsAI

The vulnerability affects Red Hat Undertow across versions that implement Jakarta WebSocket @ServerEndpoint/@OnMessage support. The Red Hat security advisory is available at https://access.redhat.com/security/cve/CVE-2026-15565 and the associated bug report at https://bugzilla.redhat.com/show_bug.cgi?id=2490628. No specific affected version range or CPE string was included in the provided intelligence data; exact version bounds should be confirmed against the Red Hat advisory. Downstream products embedding Undertow - including WildFly, JBoss EAP, and Quarkus - are potentially affected when they expose WebSocket endpoints.

RemediationAI

The primary remediation is to apply the patch released by Red Hat for Undertow; the exact fixed version should be obtained directly from https://access.redhat.com/security/cve/CVE-2026-15565, as no specific patched version number was included in the provided intelligence data. Until a patch is applied, operators can reduce exposure by restricting WebSocket upgrade requests at the reverse proxy or load balancer layer - for example, blocking or rate-limiting HTTP Upgrade headers destined for sensitive endpoints via nginx 'limit_req' or HAProxy ACLs. A trade-off is that legitimate WebSocket clients will be affected. Alternatively, if the application does not require WebSocket functionality, disabling @ServerEndpoint-annotated classes or removing WebSocket deployment descriptors eliminates the attack surface entirely. Deploying connection-count or message-rate limits at the Undertow listener level (via the 'connections-per-address' or analogous configuration) can also throttle the resource exhaustion path, though this does not fix the underlying unbounded allocation. Monitor JVM heap metrics for anomalous growth as a detection signal.