WebSocket Vulnerability in Undertow Affects Multiple Applications
CVE-2026-5680
Key Information:
What is CVE-2026-5680?
A security issue has been identified in Undertow where a remote attacker can exploit the vulnerability by sending specially crafted WebSocket messages that negotiate the permessage-deflate extension. This flaw can lead to excessive memory consumption due to the underlying PerMessageDeflateFunction.largerBuffer() method utilizing an exponential doubling algorithm. As a result, applications using the affected version may experience a Denial of Service (DoS), rendering them unavailable to legitimate users. It is crucial for organizations to evaluate their use of Undertow and apply necessary security measures to mitigate this risk.
Affected Version(s)
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:2.40.0-8.redhat_00024.1.el10eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:4.1.7-1.SP1_redhat_00001.1.el10eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:2.0.5-1.Final_redhat_00001.1.el10eap
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved