CVE-2026-5680

Awaiting Analysis Awaiting Analysis - Queue

Undertow WebSocket DoS via Permessage-Deflate

Publication date: 2026-08-27

Last updated on: 2026-09-09

Assigner: redhat-SADP

Description

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-5680

EUVD

EUVD-2026-67086

Affected Vendors & Products

Vendor	Product	Version / Range
undertow	undertow	*
redhat	undertow	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is in Undertow, a web server component. A remote attacker can send specially crafted WebSocket messages with permessage-deflate compression enabled. The flaw causes the PerMessageDeflateFunction.largerBuffer() method to use exponential memory doubling, leading to excessive memory consumption and a Denial of Service (DoS) for the affected application.

Detection Guidance

Monitor for unusually high memory usage in Undertow processes during WebSocket connections. Check for repeated WebSocket handshake attempts with permessage-deflate compression. Use system monitoring tools like top, htop, or jstack to observe memory consumption spikes in the JVM hosting Undertow.

Impact Analysis

This vulnerability can cause your application to run out of memory due to uncontrolled memory growth from processing malicious WebSocket messages. This may result in the application becoming unresponsive or crashing, disrupting service availability for legitimate users.

Compliance Impact

This vulnerability primarily impacts availability by causing Denial of Service (DoS) through excessive memory consumption. While it does not directly affect confidentiality or integrity, prolonged DoS conditions could disrupt services handling sensitive data, potentially violating compliance requirements for availability in standards like GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)).

Mitigation Strategies

Configure the PerMessageDeflateHandshake to limit maxDecompressedBufferSize to 10 MB in the Undertow constructor. Restart the affected application or service after applying the configuration change. Monitor memory usage to confirm the mitigation is effective.

Hi! I’m here to help you understand CVE-2026-5680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70