Description

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:18:58.397Z",
  "pubdate": "2026-08-27T17:18:58.397Z",
  "executiveSummary": "This vulnerability in the Undertow web server arises from improper resource management during the processing of WebSocket messages utilizing the permessage-deflate extension. The flaw facilitates a Denial of Service (DoS) attack, enabling a remote, unauthenticated attacker to exhaust system memory.\nThe core issue resides in the PerMessageDeflateFunction.largerBuffer() method, which employs an exponential buffer growth strategy. By crafting malicious WebSocket frames that trigger this expansion mechanism, an attacker can force the application to allocate excessively large memory buffers, rapidly consuming available heap space.\nThe vulnerability poses a high risk to availability, as successful exploitation results in application instability or crash due to OutOfMemoryError conditions. Because the vulnerability is reachable through standard WebSocket communication, it represents a significant threat to any service utilizing Undertow with permessage-deflate support enabled. No specific user privileges are required for exploitation, as the attack vector relies on the standard protocol negotiation process.",
  "technicalDetails": "The vulnerability is localized within the Undertow WebSocket implementation, specifically concerning the handling of the permessage-deflate extension. This extension allows for the compression of WebSocket messages, which requires the server to maintain internal buffers to decompress incoming frames.\nThe root cause is identified within the PerMessageDeflateFunction.largerBuffer() method. When the server processes a compressed WebSocket message, it must allocate a buffer to hold the decompressed data. The implementation uses an algorithm that doubles the buffer size exponentially to accommodate incoming data streams when a buffer is determined to be insufficient. This unbounded or improperly constrained exponential growth allows for the rapid escalation of memory allocation requests.\nThe attack flow proceeds as follows: 1. The attacker initiates a WebSocket connection with the target server and successfully negotiates the permessage-deflate extension. 2. The attacker transmits a series of specially crafted, compressed WebSocket frames designed to trigger the growth logic within the decompression engine. 3. The PerMessageDeflateFunction.largerBuffer() method is invoked repeatedly to expand the buffer capacity. 4. Due to the exponential nature of the growth, the heap memory usage spikes significantly with minimal input data from the attacker. 5. If the attacker sustains this activity, the JVM heap is exhausted, leading to an OutOfMemoryError, which effectively forces the application into an unresponsive state or causes a complete process termination.\nThis vulnerability is particularly dangerous because the attack can be performed over the network by any client capable of initiating a WebSocket connection. There are no authentication requirements for an attacker to reach the vulnerable code path. The impact is essentially a remote, unauthenticated Denial of Service. Because the buffer expansion logic lacks adequate upper-bound constraints or per-request resource limits, the application cannot gracefully handle the resource demand generated by the malicious payload. This behavior is symptomatic of a failure to enforce backpressure or resource quotas on protocol-level buffers during the decompression cycle of the permessage-deflate extension."
}