CVE-2026-81624
Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
- Record
CVE-2026-81624- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-68411
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
- Record
EUVD-2026-68411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p4f9-3wx9-7g8r
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in...
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
- Record
GHSA-p4f9-3wx9-7g8r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
- Record
CVE-2026-81624- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
- Record
DEBIAN-CVE-2026-81624- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-81624
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
- Record
UBUNTU-CVE-2026-81624- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
- red hat build of apache camel for spring boot 4
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat fuse 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat single sign-on 7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
undertowDebian:14 |
All versions, plus listed versions 1.3.11-11.3.16-11.3.19-11.3.21-11.3.23-1 Show 45 moreShow less1.3.4-11.3.5-11.3.7-11.4.0-11.4.1-11.4.18-11.4.20-11.4.21-11.4.21-21.4.22-11.4.23-11.4.23-21.4.23-31.4.25-11.4.25-21.4.3-11.4.4-11.4.6-11.4.7-11.4.8-12.0.23-12.0.25-12.0.26-12.0.27-12.0.28-12.0.29-12.0.30-12.1.0-12.1.1-12.1.3-12.2.0-12.2.10-12.2.12-12.2.13-12.2.14-12.2.16-12.2.17-12.2.18-12.2.19-12.2.2-12.2.20-12.2.21-12.2.3-12.2.4-12.2.5-1 |
None known |
undertowUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.4-11.3.5-11.3.7-11.3.11-11.3.16-11.3.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.4.20-11.4.21-11.4.22-11.4.23-11.4.23-2build11.4.23-31.4.23-3ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.23-12.0.27-12.0.28-12.0.29-12.0.29-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.2.8-12.2.12-12.2.13-12.2.14-12.2.16-12.2.16-1ubuntu0.1~esm1 |
None known |
undertowUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.3.8-22.3.8-2ubuntu0.1~esm1 |
None known |
undertowUbuntu:26.10 |
All versions, plus listed versions 2.3.20-1ubuntu1 |
None known |
undertowUbuntu:26.04:LTS |
All versions, plus listed versions 2.3.18-22.3.20-12.3.20-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-81624 is a high vulnerability (CVSS 7.5) in Red Hat Build Of Apache Camel For Spring Boot 4, published August 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. No source names a fixed version.
References
Left out here: 6 versions. The JSON record has them.