CVE-2026-81624

CVE-2026-81624 is a resource-exhaustion flaw (CWE-770) in Undertow's WebSocket handling, where configuration limits such as message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. A remote, unauthenticated attacker can open WebSocket connections, send large volumes of data, or hold connections open indefinitely, driving the server to exhaust memory or other resources. The impact is denial of service (crash or unavailability), with no confidentiality or integrity impact, reflected in the CVSS 3.1 score of 7.5 with high availability impact only. Any deployment using Undertow's WebSocket support is affected, most notably Red Hat JBoss EAP and WildFly, although only servers that expose WebSocket endpoints to untrusted network clients are practically reachable. There are no known public proofs of concept, the issue is not in CISA KEV, and 30-day exploitation probability is low (EPSS 0.3%).

What to do: Monitor Red Hat and WildFly security advisories for a patched Undertow release and apply the corresponding JBoss EAP/WildFly update as soon as it is published; check whether your deployments expose WebSocket endpoints to untrusted clients. As interim mitigation, front Undertow with a reverse proxy or load balancer that enforces WebSocket message-size and idle-timeout limits, disable unneeded WebSocket endpoints, and watch server heap/memory for abnormal growth.