CVE-2026-15565 in Undertow
Summary
by MITRE • 08/11/2026
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within the Undertow web server implementation where a remote attacker can trigger an out-of-memory condition through websocket endpoints. The flaw specifically targets any ServerEndpoint class that contains an OnMessage method, making it particularly dangerous as it affects standard websocket endpoint implementations. The attack requires only a standard websocket handshake without any authentication credentials, which means that any unauthenticated client can potentially exploit this vulnerability. The underlying technical issue stems from inadequate memory management during websocket message processing, where the server fails to properly validate or limit incoming message sizes or rates.
The operational impact of this vulnerability is significant as it enables a simple denial of service attack that can bring down entire websocket endpoints or even affect the overall application performance. Since no authentication is required, attackers can exploit this remotely without needing valid credentials or complex pre-requisites. The flaw essentially allows an attacker to consume excessive memory resources through carefully crafted websocket messages, leading to system instability or complete service unavailability. This type of vulnerability directly aligns with CWE-400 which addresses unchecked resource consumption and CWE-129 which deals with improper validation of array indices.
From a threat modeling perspective, this vulnerability represents a critical risk in environments where websocket endpoints are exposed to untrusted networks or users. Attackers can leverage this weakness to perform sustained denial of service attacks against applications that rely on websocket communication for real-time features such as chat applications, live notifications, or collaborative tools. The attack vector is particularly concerning because it follows standard websocket protocol handshake procedures, making it difficult to distinguish from legitimate traffic at network level. This vulnerability may also facilitate more sophisticated attacks where the initial denial of service serves as a precursor to other exploitation techniques.
The recommended mitigations include implementing proper message size limits and rate limiting mechanisms within websocket endpoint configurations. Organizations should configure memory constraints on websocket message handling and implement input validation for all incoming messages to prevent excessive resource consumption. Additionally, deploying network-level controls such as traffic shaping, connection limits, and monitoring for unusual websocket traffic patterns can help detect and prevent exploitation attempts. The fix should involve updating Undertow to a version that properly handles websocket message processing without causing memory exhaustion. Security teams should also consider implementing application firewalls or web application firewalls that can monitor and block suspicious websocket communication patterns. This vulnerability demonstrates the importance of proper resource management in concurrent programming environments and highlights the need for comprehensive security testing of all network-facing components, particularly those handling real-time communication protocols.
This flaw represents a critical weakness in websocket endpoint security that can be exploited through standard network protocols without authentication requirements. The vulnerability affects any application using Undertow's websocket implementation where ServerEndpoint classes contain OnMessage methods, making it broadly applicable across many enterprise applications. The combination of low attack complexity and high impact makes this particularly dangerous for production environments, as attackers only need to establish a basic websocket connection to begin the denial of service attack. Organizations should prioritize patching affected systems and implementing additional monitoring controls to detect potential exploitation attempts.