Vulnerability · Published Aug 11, 2026 · Assigned by redhat
CVE-2026-15565Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method
High 7.5
In plain English
A high-severity buffer overflow in Red Hat JBoss Enterprise Application Platform 7.4.25 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 36.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | undertow | no fix listed | DEBIAN-CVE-2026-15565 |
| Ubuntu:26.04:LTS | undertow | no fix listed | UBUNTU-CVE-2026-15565 |
| Ubuntu:26.10 | undertow | no fix listed | UBUNTU-CVE-2026-15565 |
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:53644 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:53806 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70228 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70229 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70230 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70277 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-15565 vdb-entry, x_refsource_REDHAT
- RHBZ#2490628 issue-tracking, x_refsource_REDHAT