CVE-2026-81624 — Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration l…
Published: 2026-08-31 · CVSS: 7.5 · CVSS 3.1
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7