CVE-2026-15565

Summary

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

Affected Software

Weaknesses

• CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Workarounds

Option 1 — Server-wide configuration to disable websockets handshake: <!– Remove <websockets/> from standalone.xml servlet-container –> <servlet-container name="default"> <jsp-config/> <!– <websockets/> ← remove this line entirely –> </servlet-container> isWebsocketsEnabled() returns false → no WebSocket upgrade accepted for any deployment.

Option 2 — Per-application configuration to disable websockets handshake: <!– WEB-INF/jboss-web.xml inside the WAR –> <jboss-web> <enable-websockets>false</enable-websockets> </jboss-web> Only that specific WAR's @ServerEndpoint classes are not registered.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2026-15565
• https://bugzilla.redhat.com/show_bug.cgi?id=2490628

• ←Previous
• Next→