REDHAT-BUG-2524868: High severity Undertow vulnerability
A vulnerability was found in Undertow where the WebSocketContainer and its boot process do not allow setting the binaryBuffer and textBuffer sizes, along with session duration and async send timeout. These parameters default to infinite. This is a follow-up to CVE-2026-5680, as the initial fix allowed setting buffer sizes for certain types but left async send and session duration as infinite and inaccessible for configuration. An attacker could exploit these infinite defaults to cause resource exhaustion or an Out of Memory (OOME) condition on the server.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Undertow deployments using WebSocketContainer are exposed because the binary and text buffer sizes, session duration, and asynchronous send timeout default to infinite and cannot be configured through the affected boot process.
What does an attacker need to do to exploit it?
An attacker would need to interact with the server's WebSocket functionality in a way that consumes unbounded resources. The stated impact is resource exhaustion or an out-of-memory condition on the server.
Are the default settings affected?
Yes. The affected parameters default to infinite, including session duration and asynchronous send timeout; the description also identifies binary and text buffer sizes as defaulting to infinite.