EUVD-2026-67086
GHSA-28vh-mg6p-gxg7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable WebSocket endpoint, no auth required, no confidentiality or integrity impact, high availability impact from memory exhaustion.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.
AnalysisAI
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application expose a WebSocket endpoint backed by Undertow with the permessage-deflate extension enabled or negotiable - this is the key limiting condition, as not all Undertow deployments enable WebSocket or the compression extension. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 assigns AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a 7.5 High score reflecting that unauthenticated remote attackers can reach the vulnerable code over the network with no special conditions beyond a WebSocket-capable endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply Red Hat's patches for the affected product lines as published via the Red Hat Security Advisory linked at https://access.redhat.com/security/cve/CVE-2026-5680 and tracked in Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2455350. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Red Hat JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and Undertow deployments (via rpm -qa | grep undertow on RHEL 8/9/10); assess which systems expose WebSocket endpoints to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today