Description

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T09:17:03.453Z",
  "pubdate": "2026-08-31T09:17:03.453Z",
  "executiveSummary": "This vulnerability concerns a resource exhaustion flaw within the Undertow web server, specifically affecting WebSocket connection handling. The issue stems from a lack of configurable constraints on message buffer sizes and session timeouts, which default to an unlimited state. This design oversight allows remote, unauthenticated attackers to initiate WebSocket connections and consume server-side resources indefinitely.\nBy transmitting abnormally large data payloads or maintaining dormant connections, an attacker can trigger memory exhaustion (Out-of-Memory) or thread starvation, leading to a Denial of Service (DoS) condition. The vulnerability impacts systems running Undertow, including JBoss EAP and WildFly. The risk is significant as it requires minimal technical sophistication to exploit and can lead to complete service unavailability. No authentication is required for an attacker to initiate the malicious WebSocket handshakes, making this a high-priority exposure for internet-facing infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of WebSocket resource management within the Undertow engine. While Undertow is designed for performance and flexibility, it fails to enforce strict resource boundaries by default for WebSocket sessions. Specifically, the mechanisms governing the allocation of message buffers and the enforcement of connection idle timeouts are missing or implicitly set to infinite values, bypassing traditional server-side hardening controls.\nThe attack flow begins when an attacker initiates a standard WebSocket handshake with an Undertow-based server. Once the connection is established, the attacker can leverage the lack of buffer size constraints to flood the server with oversized WebSocket frames. Because the underlying infrastructure does not proactively terminate or throttle these requests, the JVM heap memory is rapidly consumed by the accumulating data buffers, ultimately resulting in an Out-of-Memory (OOM) error that crashes the affected JVM instance.\nSimultaneously, the absence of enforced session timeouts allows an attacker to open a high volume of concurrent WebSocket connections and hold them in an idle state indefinitely. By accumulating these stagnant connections, the attacker can exhaust the server's available thread pools or connection limits. This prevents legitimate users from establishing new sessions, effectively resulting in a resource-exhaustion-based Denial of Service.\nThe vulnerable component is the Undertow WebSocket integration layer. Because this component is tightly coupled with JBoss EAP and WildFly, any application utilizing these platforms to expose WebSocket endpoints is inherently exposed. The exploitation does not require prior authentication or elevated privileges, as the vulnerability is triggered during the standard connection and communication lifecycle. Network exposure is limited only by the reachability of the WebSocket endpoint. Post-exploitation, the server may require manual intervention and a full restart to recover from the memory corruption or resource depletion caused by the attack. Since the default configuration facilitates this behavior without requiring complex payloads, the attack surface remains wide across all standard installations of the affected products."
}