Undertow CVE-2026-81624

Exploitation requires that the target application exposes at least one WebSocket endpoint through Undertow - deployments that serve only HTTP/REST with no WebSocket upgrade path are not exploitable. The unlimited buffer and timeout defaults are the factory condition in affected versions; no administrator misconfiguration is required to be vulnerable. The CVSS PR:N/UI:N/AV:N/AC:L vector confirms no authentication, no user interaction, and no attack complexity. Exploitation is strictly bounded to availability impact (C:N/I:N/A:H, S:U): an attacker cannot read data or modify application state through this vector. The primary limiting factor is that the attacker must be able to reach the WebSocket endpoint over the network - network segmentation or firewall rules blocking WebSocket upgrade requests to Undertow reduce exploitability.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects an availability-only, network-reachable, unauthenticated attack with no complexity barriers. The scope is ungranged (S:U), meaning the blast radius is confined to the Undertow process itself rather than spreading to adjacent systems. No EPSS data was provided, and this CVE does not appear in CISA KEV, nor is any POC reported - so no public exploit has been identified at time of analysis. Despite the absence of known exploit code, the attack concept is operationally trivial: any developer familiar with WebSocket libraries can replicate it without a published PoC, which makes the effective exploitation barrier lower than EPSS absence might suggest. The confidentiality and integrity metrics (C:N/I:N) confirm this is a pure denial-of-service class; data is not at risk directly. However, a crashed JBoss EAP instance hosting business-critical applications - including SSO flows via Red Hat Single Sign-On 7 or integration pipelines via Red Hat Fuse 7 - represents a meaningful operational impact, and even mid-tier enterprise operators should not deprioritize remediation solely on the basis of no observed active exploitation.

An unauthenticated remote attacker opens many simultaneous WebSocket connections to a vulnerable Undertow endpoint and continuously streams large message frames, relying on Undertow's unlimited buffer allocation to consume JVM heap until an OutOfMemoryError terminates the application server process. Alternatively, the attacker holds a smaller number of connections open indefinitely without transmitting data, exploiting the unlimited session timeout default to prevent connection reaping. No published exploit code is required - standard WebSocket client libraries (e.g., Python websockets, wscat) are sufficient to execute this attack.