Description

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T09:17:13.370Z",
  "pubdate": "2026-08-11T09:17:13.370Z",
  "executiveSummary": "A denial of service vulnerability exists in the Undertow web server affecting WebSocket endpoints. The flaw allows an unauthenticated remote attacker to exhaust server memory resources, leading to an Out of Memory (OOM) condition.\nThe vulnerability resides in the handling of WebSocket connections on any annotated @ServerEndpoint class featuring an @OnMessage method. By leveraging standard WebSocket handshake mechanisms, malicious actors can trigger memory exhaustion without requiring prior authentication or valid session credentials.\nThe primary impact of this vulnerability is a complete Denial of Service (DoS) affecting availability, as the targeted application server crashes or becomes unresponsive due to memory depletion.\nThe attack vector is network-based and exploitable remotely over the WebSocket protocol. Because exploitation requires only standard protocol interactions and no privileged access, the risk implications are severe for exposed services utilizing vulnerable Undertow configurations.\nMitigation requires applying vendor-supplied patches or updates that properly manage memory allocation and resource bounds during the WebSocket handshake and message processing phases.",
  "technicalDetails": "The vulnerability stems from improper resource management and memory allocation within the Undertow WebSocket subsystem when processing incoming connections and message frames.\nThe vulnerable component involves the WebSocket endpoint implementation, specifically targeting any class annotated with @ServerEndpoint that implements an @OnMessage method to handle incoming payload data.\nExploitation occurs at the network layer over the WebSocket protocol. An unauthenticated attacker initiates a standard WebSocket handshake against the target endpoint.\nUpon establishing the connection handshake, the attacker transmits crafted payloads or initiates connection states that cause the server to allocate excessive memory resources without adequate bounds checking or rate limiting.\nThe root cause permits uncontrolled memory consumption during the parsing and handling of WebSocket frames before authentication or application-level access controls are evaluated.\nBecause the vulnerable endpoints lack mandatory authentication checks prior to resource allocation, external network entities can repeatedly trigger the memory-intensive code path.\nThe attack flow proceeds as follows: 1) The attacker connects to the target WebSocket endpoint using the standard handshake procedure; 2) The server allocates buffers or structures associated with the @ServerEndpoint and @OnMessage handlers; 3) The unauthenticated input forces the JVM heap to deplete rapidly as unbound allocations accumulate; 4) The Java Virtual Machine triggers an Out of Memory error, crashing the process or rendering the service entirely unresponsive.\nThe post-exploitation impact is strictly limited to availability disruption, manifesting as an application crash or system-wide Denial of Service affecting concurrent users and services hosted on the same instance."
}