CVE-2026-81624
Received Received - Intake

Memory Exhaustion in Undertow WebSocket Connections

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: redhat-SADP

Description
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-81624
EUVD
EUVD-2026-68411

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat undertow *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Undertow web server's WebSocket handling. It occurs because critical configuration limits like message buffer sizes and session timeouts default to unlimited values. An attacker can exploit this by sending large amounts of data or maintaining connections indefinitely, causing the server to exhaust memory or other resources and potentially crash.

Detection Guidance

Monitor for unusual memory usage or connection spikes in Undertow servers. Check WebSocket session durations and buffer sizes in logs. Use system monitoring tools like top, htop, or netstat to detect high memory consumption or excessive open connections.

Impact Analysis

This vulnerability can lead to denial-of-service conditions. An attacker could crash your server by overwhelming it with data or keeping connections open indefinitely, which may disrupt services relying on Undertow, such as JBoss EAP or WildFly.

Mitigation Strategies

Upgrade Undertow to a patched version if available. Configure WebSocket buffer sizes and session timeouts manually in the server configuration. Restrict network access to WebSocket endpoints via firewalls or load balancers to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart