---
id: CVE-2026-81624
title: Undertow is a flexible performant web server used in JBoss EAP and WildFly
summary: >-
  Undertow is a flexible performant web server used in JBoss EAP and WildFly. A
  flaw was found in how Undertow handles WebSocket connections. Specifically,
  certain configuration limits like message buffer sizes and session timeouts
  cannot …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: Red Hat
product: undertow-core
affected:
  - undertow-core (all versions)
  - moditect
  - 'pki-core:10.6/resteasy'
  - 'pki-deps:10.6/resteasy'
  - resteasy
  - undertow-core (all versions)
  - jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)
  - jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)
  - undertow-core (all versions)
  - undertow-core (all versions)
  - undertow-core
  - undertow-core (all versions)
published: '2026-08-31'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T08:16:59.283'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81624'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-81624'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2524868'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81624.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-81624'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81624'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-01T15:07:47.111478Z'
epss: 0.00582
epssPercentile: 0.45467
ingestedAt: '2026-09-10T07:40:24.113Z'
---

## Overview

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 · no fix planned: Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Red Hat build of Apache Camel for Spring Boot 4, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81624.json)