What is the CVSS score of EUVD-2026-55985?

EUVD-2026-55985 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Red Hat EAP are affected by EUVD-2026-55985?

Red Hat EAP deployments are vulnerable to a high-severity denial-of-service attack that allows unauthenticated remote attackers to crash application servers through crafted HTTP requests, impacting…. A patch is available.

How to fix or mitigate EUVD-2026-55985?

Within 24 hours, conduct an inventory of all Red Hat EAP deployments and their internet exposure, prioritizing production systems. Within 7 days, implement interim protections by deploying Web Application Firewall (WAF) rules to block malformed chunked-transfer requests, configure HTTP connection limits and request timeouts on affected Undertow listeners, and enable monitoring for exploitation attempts. Within 30 days, continue monitoring Red Hat's advisory channels for a vendor-released patch, and plan deployment procedures for when patches become available, considering rolling updates to minimize availability impact.

Red Hat EAP EUVD-2026-55985

| CVE-2026-15561 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-11 secalert@redhat.com

GHSA-fhmg-q5fc-2m8v

Denial Of Service

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible listener, no auth or interaction required; only availability impacted via unbounded heap allocation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:34 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

HIGH 7.5

DescriptionCVE.org

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

AnalysisAI

Denial of service in Red Hat EAP's Undertow HTTP/1.1 chunked-transfer decoder allows unauthenticated remote attackers to exhaust JVM heap memory by sending crafted requests with no chunk size or count limits enforced. The OutOfMemoryError triggered halts all deployments on the affected listener, not just the targeted application. CVSS metrics (AV:N/AC:L/PR:N/UI:N/A:H) confirm trivial exploitability with no authentication and no special conditions, making this a high-priority availability risk for any internet-facing EAP deployment. No public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

Red Hat EAP (Enterprise Application Platform) uses Undertow as its embedded high-performance, non-blocking web server. HTTP/1.1 chunked transfer encoding is a standard mechanism (RFC 7230) that allows request or response bodies to be transmitted in discrete chunks without a prior Content-Length declaration. The Undertow decoder for this encoding is affected by CWE-770 (Allocation of Resources Without Limits or Throttling): it fails to enforce any upper bounds on either the size of individual chunks or the total count of chunks per request. An attacker can exploit this by streaming an unbounded sequence of chunks, causing the JVM to continuously allocate heap memory until GC cannot reclaim it and an OutOfMemoryError is thrown. Because the JVM heap is shared across all deployments, this crash is not isolated - it terminates all applications on the listener, amplifying the blast radius beyond a single application.

RemediationAI

Apply the Red Hat-issued patch via the official security advisory at https://access.redhat.com/security/cve/CVE-2026-15561; no exact fix version was available in the input data and should be confirmed directly against the advisory. As an interim compensating control, deploy a reverse proxy (e.g., HAProxy, Apache httpd mod_proxy) in front of EAP configured with strict limits on chunked request body size and count - note this adds latency and requires proxy tuning specific to application payload expectations. Alternatively, restrict network-level access to the Undertow listener to known trusted IP ranges via firewall rules, reducing the attack surface to authorized clients only; this does not fix the root cause and is not viable for public-facing deployments. Disabling HTTP/1.1 chunked transfer entirely is not a practical workaround as it would violate HTTP/1.1 compliance and break standard clients.