CVE-2026-15565: Undertow WebSocket DoS Vulnerability

CVE-2026-15565 Overview

A flaw in Undertow allows unauthenticated remote attackers to trigger Out of Memory conditions on WebSocket endpoints. The vulnerability affects any @ServerEndpoint class that declares an @OnMessage handler. Attackers exploit the flaw using only a standard WebSocket handshake, requiring no credentials or user interaction. Successful exploitation results in a Denial of Service against the target Java application server. The issue is tracked under [CWE-120] (Buffer Copy without Checking Size of Input) and affects Undertow, the embedded web server used in Red Hat JBoss EAP and WildFly deployments.

Critical Impact
Unauthenticated remote attackers can exhaust server memory on any WebSocket endpoint that processes messages, crashing the application without valid credentials.

Affected Products

Undertow (used in Red Hat JBoss Enterprise Application Platform)
Applications exposing @ServerEndpoint classes with @OnMessage methods
Red Hat products referenced in RHSA-2026:53806

Discovery Timeline

2026-08-11 - CVE-2026-15565 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15565

Vulnerability Analysis

The vulnerability resides in Undertow's WebSocket message handling path. When a server declares an endpoint using the JSR-356 @ServerEndpoint annotation and registers an @OnMessage handler, Undertow accepts incoming WebSocket frames without adequate bounds enforcement on buffered data. A remote attacker completes a standard WebSocket handshake and then streams data that Undertow accumulates in memory. The lack of upstream size validation allows the buffered payload to grow until the Java Virtual Machine exhausts heap space. Confidentiality and integrity remain unaffected, but availability collapses once the JVM throws OutOfMemoryError or the process becomes unresponsive.

Root Cause

The root cause is a buffer copy operation performed without checking input size, classified as [CWE-120]. Undertow's WebSocket subsystem trusts client-supplied frame data during message aggregation. No per-connection or per-message ceiling halts memory growth before it impacts the JVM.

Attack Vector

The attack requires network reachability to the WebSocket endpoint and nothing else. An attacker initiates a WebSocket upgrade against any exposed @ServerEndpoint route, then transmits crafted or oversized frames. Because authentication is not required at the handshake layer for many deployments, the attack surface includes public-facing Java application servers running Undertow. A single low-bandwidth client can degrade or crash a server, and multiple parallel connections amplify the impact.

No verified public exploit code is currently available. Refer to the Red Hat CVE-2026-15565 advisory and Red Hat Bug Report #2490628 for vendor-provided technical details.

Detection Methods for CVE-2026-15565

Indicators of Compromise

Sudden JVM heap exhaustion or OutOfMemoryError entries in application server logs coinciding with WebSocket traffic
Repeated WebSocket handshake requests (Upgrade: websocket) from a single source IP followed by abnormal frame volume
Unresponsive Undertow, WildFly, or JBoss EAP processes with elevated resident memory prior to termination

Detection Strategies

Monitor WebSocket connection metrics for sessions with unusually large aggregated payload sizes on @OnMessage handlers
Correlate JVM garbage collection pressure and heap usage spikes with WebSocket endpoint access logs
Alert on repeated crashes or restarts of Java application server processes hosting WebSocket endpoints

Monitoring Recommendations

Enable Undertow access logging and capture WebSocket upgrade requests with source IP, endpoint path, and session duration
Instrument JVM heap metrics via JMX or an APM agent and set thresholds tied to baseline WebSocket workload
Forward application server logs to a centralized SIEM for correlation with network-layer anomalies

How to Mitigate CVE-2026-15565

Immediate Actions Required

Apply the Undertow packages delivered in RHSA-2026:53806 or the equivalent update for your distribution
Inventory applications exposing @ServerEndpoint classes with @OnMessage handlers and prioritize internet-facing services
Restrict WebSocket endpoint exposure to authenticated users or trusted network segments where feasible

Patch Information

Red Hat has released updated Undertow packages via RHSA-2026:53806. Consult the Red Hat CVE-2026-15565 page for the complete list of affected products and fixed versions. Downstream consumers of Undertow, including WildFly and JBoss EAP, should upgrade to the patched builds identified in the vendor advisory.

Workarounds

Place a reverse proxy or WAF in front of Undertow to enforce maximum WebSocket message size and per-connection rate limits
Require authentication at the reverse proxy for WebSocket upgrade requests to reduce unauthenticated attack surface
Configure JVM heap limits and container memory ceilings so a single crashed instance does not affect co-located services

bash

# Example nginx configuration limiting WebSocket frame size and connection rate
http {
    limit_conn_zone $binary_remote_addr zone=ws_conn:10m;
    limit_req_zone  $binary_remote_addr zone=ws_req:10m rate=10r/s;

    server {
        location /ws/ {
            limit_conn ws_conn 5;
            limit_req  zone=ws_req burst=20 nodelay;

            client_max_body_size 64k;

            proxy_pass http://undertow_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_read_timeout 60s;
        }
    }
}