CVE-2026-5680

CVE-2026-5680 is a resource-exhaustion flaw (CWE-770) in Undertow, the Java web server that serves as the default HTTP listener in Red Hat's WildFly and JBoss EAP application servers and is also embedded in other Java applications. A remote, unauthenticated attacker triggers it by sending specially crafted WebSocket messages to an endpoint where the permessage-deflate compression extension is negotiated; the PerMessageDeflateFunction.largerBuffer() method doubles buffer sizes exponentially, so memory consumption can grow without bound during decompression. The attacker gains denial of service only — there is no code execution or data exposure (CVSS 3.1 7.5 with C:N/I:N/A:H). Any deployment running Undertow with WebSocket support enabled is affected, and because Red Hat is the assigning CNA, fixes are expected through Red Hat/WildFly/JBoss EAP advisories. As of now there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.4% (34th percentile), indicating no known exploitation.

What to do: Update Undertow through your distribution's update channel (Red Hat, WildFly, or JBoss EAP advisories) as fixed packages become released. As an interim mitigation, disable or restrict permessage-deflate negotiation on WebSocket endpoints or limit untrusted WebSocket clients, and monitor heap usage for abnormal growth. First confirm whether your deployments actually expose WebSocket endpoints — servers without WebSocket traffic are not exposed to this flaw.