Undertow EUVD-2026-67086

Exploitation requires that the target application expose a WebSocket endpoint backed by Undertow with the permessage-deflate extension enabled or negotiable - this is the key limiting condition, as not all Undertow deployments enable WebSocket or the compression extension. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that when a WebSocket endpoint is accessible, no authentication, user interaction, or special network position is required. Exploitation is limited to services where: (1) WebSocket is enabled and accessible, (2) the permessage-deflate extension is negotiable during the handshake. Deployments that do not expose WebSocket endpoints, or that disable the permessage-deflate extension via server configuration, are not exploitable. The attack affects JVM heap memory and may be rate-limited in practice by connection-level throttling if present, but no such throttling is inherent in the vulnerable code path.

CVSS 3.1 assigns AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a 7.5 High score reflecting that unauthenticated remote attackers can reach the vulnerable code over the network with no special conditions beyond a WebSocket-capable endpoint. The attack complexity is genuinely low because permessage-deflate negotiation is a standard part of the WebSocket handshake and does not require bypassing any additional authentication. No EPSS score was provided in the input data, and the CVE is not listed in CISA KEV, meaning no confirmed active exploitation has been established - this reduces practical urgency compared to an equivalent KEV-listed flaw. The impact is limited entirely to availability (A:H); there is no confidentiality or integrity risk. Real-world priority should be high for any organization exposing Undertow-backed WebSocket endpoints on the public internet or to untrusted internal networks, as a single persistent client could trigger an out-of-memory condition crashing the JVM process. Even a mid-sized municipal IT team in olsztyn running JBoss EAP behind a corporate firewall should treat this as an elevated priority if WebSocket endpoints are reachable from untrusted segments, since the attack is trivially automatable - SSVC: exploitation=none, automatable=yes, technical impact=partial, suggesting patch-track priority.

An unauthenticated attacker connects to any Undertow-backed WebSocket endpoint and negotiates the permessage-deflate extension during the handshake. The attacker then sends a stream of crafted compressed WebSocket messages designed to trigger repeated largerBuffer() calls, causing the JVM heap to grow exponentially until memory is exhausted. This results in an OutOfMemoryError, crashing the application server process and causing a denial of service for all users. No public exploit code was identified at time of analysis, but the attack is straightforward to implement given the public description of the vulnerable code path.