CVE-2026-15561: Undertow-core: oom via missing limits in chunked trailer in eap's undertow

Published Aug 11, 2026

Updated

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

Affected Software

1 affected component

EAP Undertow-core

Event History

Aug 11, 2026

CVE Published

via MITRE·08:49 AM

Data Sourced

via MITRE·08:49 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-15561?

CVE-2026-15561 has a severity rating of 7.5, indicating a high risk level.

What impact does CVE-2026-15561 have on my system?

CVE-2026-15561 could lead to an OutOfMemory error, resulting in Denial of Service for your applications.

How do I fix CVE-2026-15561?

To address CVE-2026-15561, implement limits on size and count in the chunked trailer of the undertow server.

What software is affected by CVE-2026-15561?

CVE-2026-15561 specifically affects the EAP Undertow-core component.

What type of vulnerability is CVE-2026-15561?

CVE-2026-15561 is categorized as a Denial of Service vulnerability due to unbounded resource consumption.

CVE-2026-15561: Undertow-core: oom via missing limits in chunked trailer in eap's undertow

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-15561?

What impact does CVE-2026-15561 have on my system?

How do I fix CVE-2026-15561?

What software is affected by CVE-2026-15561?

What type of vulnerability is CVE-2026-15561?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-15561?

What impact does CVE-2026-15561 have on my system?

How do I fix CVE-2026-15561?

What software is affected by CVE-2026-15561?

What type of vulnerability is CVE-2026-15561?