{"id":"CVE-2026-81624","title":"Undertow is a flexible performant web server used in JBoss EAP and WildFly","summary":"Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"Red Hat","product":"undertow-core","affected":["undertow-core (all versions)","moditect","pki-core:10.6/resteasy","pki-deps:10.6/resteasy","resteasy","undertow-core (all versions)","jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)","jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)","jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)","undertow-core (all versions)","undertow-core (all versions)","undertow-core","undertow-core (all versions)"],"published":"2026-08-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T08:16:59.283","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81624","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-81624","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524868","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81624.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81624"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81624"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-01T15:07:47.111478Z"},"epss":0.00332,"epssPercentile":0.26628,"ingestedAt":"2026-09-10T07:40:24.113Z","slug":"CVE-2026-81624","body":"## Overview\n\nUndertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 · no fix planned: Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat build of Apache Camel for Spring Boot 4, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81624.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}