EUVD-2026-68411
GHSA-p4f9-3wx9-7g8r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable WebSocket endpoint requires no authentication or interaction; impact is availability-only with no scope change or data exposure.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
AnalysisAI
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application exposes at least one WebSocket endpoint through Undertow - deployments that serve only HTTP/REST with no WebSocket upgrade path are not exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects an availability-only, network-reachable, unauthenticated attack with no complexity barriers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Red Hat-issued patch for the specific affected product as documented at https://access.redhat.com/security/cve/CVE-2026-81624 and tracked in Bugzilla #2524868 (https://bugzilla.redhat.com/show_bug.cgi?id=2524868). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today