CVE-2026-15561
Received Received - Intake

Undertow HTTP/1.1 Chunked Transfer Decoder Denial of Service

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Red Hat, Inc.

Description
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-15561
EUVD
EUVD-2026-55985

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat jboss_enterprise_application_platform *-*
red_hat undertow *-*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Undertow HTTP/1.1 chunked-transfer decoder used by Red Hat's JBoss Enterprise Application Platform (EAP). It allows an unauthenticated attacker to send a specially crafted request with an excessively large trailer section after the terminal chunk. Since the decoder lacks size or count limits for this trailer, the JVM runs out of memory and crashes, causing a denial-of-service (DoS) by stopping all deployments on the affected listener.

Detection Guidance

Monitor for OutOfMemory errors in JVM logs or Undertow components. Check for unusually large HTTP chunked-transfer trailer sections in network traffic. Use tools like Wireshark to inspect HTTP/1.1 chunked-transfer encoding for excessive trailer sizes.

Impact Analysis

An attacker could exploit this to crash the JVM hosting your JBoss EAP applications, leading to downtime for all services on the affected server. This is especially critical in direct-edge or L4/TCP load-balanced setups where no layer 7 proxy is present to filter malicious traffic.

Mitigation Strategies

Apply vendor patches from Red Hat for affected JBoss EAP or Undertow versions. Deploy a layer 7 reverse proxy (nginx, HAProxy in HTTP mode, or ALB) in front of vulnerable systems. Restrict unauthenticated TCP connections to vulnerable listeners.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart