CVE-2026-15561 in Undertow
Summary
by MITRE • 08/11/2026
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability resides within the Undertow HTTP/1.1 chunked-transfer decoding implementation in the Enterprise Application Platform, specifically targeting the handling of chunked data transmission. This flaw represents a critical security weakness that allows unauthorized attackers to exploit memory management deficiencies in the HTTP processing pipeline. The vulnerability stems from inadequate parameter validation and absence of size and count restrictions during chunked transfer decoding operations, creating an exploitable condition that can be leveraged for service disruption.
The technical implementation flaw manifests when the Undertow server processes incoming HTTP requests containing chunked transfer encoding without enforcing proper limits on either the number of chunks or their individual sizes. This absence of validation creates a path where an attacker can craft malicious HTTP requests with excessive chunk counts or oversized individual chunks, causing the JVM to consume escalating amounts of memory during processing. The vulnerability operates at the protocol level within the HTTP/1.1 implementation, specifically targeting the chunked transfer encoding decoder component that handles data segmentation for transmission.
From an operational impact perspective, this vulnerability enables a remote attacker with no authentication requirements to initiate a denial-of-service condition that affects the entire application server. The attack results in OutOfMemoryError exceptions that can overwhelm the JVM's memory management system, leading to complete service interruption and potentially affecting all deployed applications on the affected listener. The resource exhaustion occurs during normal HTTP request processing, making it particularly dangerous as it can be triggered by routine network traffic without requiring special privileges or prior access to the system.
The attack vector exploits fundamental weaknesses in the HTTP protocol implementation and represents a classic example of a resource exhaustion attack pattern that aligns with common threat models documented in the attack framework. This vulnerability directly relates to CWE-770, which addresses allocation of resources without limits or with inadequate limits, and can be categorized under ATT&CK technique T1499.3 for Network Denial of Service attacks. The lack of input validation and resource limiting mechanisms creates an environment where attackers can systematically consume available memory resources until the system becomes unresponsive.
Mitigation strategies should focus on implementing strict parameter validation for chunked transfer encoding operations, including enforcing maximum chunk count limits and individual chunk size restrictions. Security measures must include JVM memory tuning to prevent complete service exhaustion, proper input sanitization at the HTTP level, and network-level rate limiting to reduce the impact of potential attacks. Regular monitoring and alerting should be implemented to detect unusual memory consumption patterns that may indicate exploitation attempts, while application-level firewalls can help filter malicious chunked requests before they reach the vulnerable Undertow components.