Vulnerability · Published Aug 27, 2026 · Assigned by redhat
CVE-2026-5680Undertow-core: undertow: denial of service via websocket permessage-deflate processing
High 7.5
In plain English
A high-severity resource allocation without limits in Red Hat JBoss Enterprise Application Platform 8.1.8.GA from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | undertow | no fix listed | DEBIAN-CVE-2026-5680 |
| Ubuntu:26.04:LTS | undertow | no fix listed | UBUNTU-CVE-2026-5680 |
| Ubuntu:26.10 | undertow | no fix listed | UBUNTU-CVE-2026-5680 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:70228 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70229 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70230 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70277 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-5680 vdb-entry, x_refsource_REDHAT
- RHBZ#2455350 issue-tracking, x_refsource_REDHAT