CVE-2026-15561: Undertow HTTP/1.1 DoS Vulnerability

CVE-2026-15561 Overview

A flaw exists in the Undertow HTTP/1.1 chunked-transfer decoder shipped with Red Hat JBoss Enterprise Application Platform (EAP). The decoder omits limits on chunk size and chunk count, allowing an unauthenticated remote attacker to exhaust JVM heap memory. Exploitation drives the Java Virtual Machine to an OutOfMemoryError, halting every deployment bound to the affected HTTP listener and producing a denial-of-service condition.

The weakness is tracked as CWE-770: Allocation of Resources Without Limits or Throttling. The vulnerability targets availability only; confidentiality and integrity remain unaffected.

Critical Impact
An unauthenticated network attacker can crash the JVM and stop all deployments on the affected HTTP listener, causing a full service outage.

Affected Products

Red Hat JBoss Enterprise Application Platform (EAP) using the Undertow HTTP/1.1 chunked-transfer decoder
Undertow HTTP subsystem components referenced in RHSA-2026:53644
Undertow HTTP subsystem components referenced in RHSA-2026:53806

Discovery Timeline

2026-08-11 - CVE-2026-15561 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15561

Vulnerability Analysis

Undertow is the embedded web server that powers HTTP handling in Red Hat JBoss EAP. Its HTTP/1.1 parser accepts requests using the Transfer-Encoding: chunked framing defined in RFC 9112. The chunked decoder reads each chunk header, allocates buffer space, and reassembles the payload before forwarding it to the deployed application.

The decoder does not enforce upper bounds on individual chunk size or on the total number of chunks per request. An attacker can send a single connection that streams either one very large chunk or a long series of chunks, forcing Undertow to allocate memory without release. The Java heap grows until the JVM raises an OutOfMemoryError.

When that error triggers, every application deployed on the affected HTTP listener stops serving traffic. Recovery requires restarting the JVM process. Because the attack path is anonymous HTTP, any exposed listener is reachable without credentials.

Root Cause

The root cause is missing input validation on request body framing. The chunked decoder lacks the size and count ceilings expected under CWE-770. Without those ceilings, request handling scales linearly with attacker-controlled input and consumes JVM heap until allocation fails.

Attack Vector

The attack is network-reachable, requires no authentication, and needs no user interaction. An attacker opens a TCP connection to an EAP HTTP listener and issues a POST or PUT request that declares Transfer-Encoding: chunked. The attacker then streams oversized or excessively numerous chunks until the JVM exhausts heap memory. See the Red Hat CVE analysis for vendor detail.

Detection Methods for CVE-2026-15561

Indicators of Compromise

java.lang.OutOfMemoryError: Java heap space entries in EAP server logs correlated with active HTTP/1.1 traffic
Sudden termination or unresponsiveness of all deployments bound to a single Undertow HTTP listener
HTTP access logs showing long-lived POST or PUT requests with Transfer-Encoding: chunked from a single source
JVM heap dumps dominated by Undertow buffer allocations tied to the chunked decoder

Detection Strategies

Alert on repeated OutOfMemoryError events in server.log on EAP hosts
Monitor for HTTP requests where the cumulative chunked body size exceeds expected application limits
Baseline normal request body sizes per endpoint and flag statistical outliers on chunked transfers
Correlate connection-level metrics with JVM heap growth to identify slow-drain memory attacks

Monitoring Recommendations

Enable Undertow access logging with request byte counts and connection duration fields
Export JVM heap and garbage collection metrics to a central telemetry pipeline
Track HTTP listener thread pool saturation and connection queue depth for anomalies
Forward EAP and JVM logs to the Singularity Data Lake for correlation and long-term retention

How to Mitigate CVE-2026-15561

Immediate Actions Required

Apply the Red Hat updates published in RHSA-2026:53644 and RHSA-2026:53806 to all affected EAP instances
Restrict direct exposure of EAP HTTP listeners to untrusted networks by routing traffic through a hardened reverse proxy
Enforce request body size limits at upstream load balancers or web application firewalls
Restart the JVM after applying patches to clear any partially degraded state

Patch Information

Red Hat has published fixes in RHSA-2026:53644 and RHSA-2026:53806. Vendor tracking details are available in the Red Hat CVE page for CVE-2026-15561 and Red Hat Bugzilla #2483133. Apply the errata that matches your EAP version and supported channel.

Workarounds

Terminate HTTP/1.1 at a reverse proxy that caps request body size and chunk count before forwarding to EAP
Configure max-post-size and related limits on the Undertow HTTP listener to bound request memory allocation
Apply rate limiting and connection ceilings per source IP at the network edge to reduce sustained memory pressure
Isolate exposed EAP listeners behind authenticated network segments where feasible

bash

# Configuration example: set Undertow request size ceiling via JBoss CLI
/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=max-post-size,value=10485760)
reload