CVE-2026-81624: Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
A vulnerability was found in Undertow where the WebSocketContainer and its boot process do not allow setting the binaryBuffer and textBuffer sizes, along with session duration and async send timeout. These parameters default to infinite. This is a follow-up to CVE-2026-5680, as the initial fix allowed setting buffer sizes for certain types but left async send and session duration as infinite and inaccessible for configuration. An attacker could exploit these infinite defaults to cause resource exhaustion or an Out of Memory (OOME) condition on the server.
Other sources
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Servers using Undertow with WebSocket connections are exposed, including Undertow deployments in JBoss EAP and WildFly. The vulnerable behavior concerns WebSocketContainer defaults that leave message buffers and connection-related timeouts unlimited.
What does an attacker need to exploit it?
A remote attacker can exploit the issue by sending large volumes of WebSocket data or keeping WebSocket connections open indefinitely. The supplied severity vector indicates no privileges or user interaction are required.
Are default settings affected?
Yes. The affected binary and text buffer sizes, session duration, and asynchronous send timeout default to infinite values and cannot be configured through the affected boot process.
What is the likely impact of successful exploitation?
An attacker may exhaust server memory or other resources, potentially causing an out-of-memory condition and crashing the server. The reported impact is availability loss rather than confidentiality or integrity loss.