A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
History

Wed, 21 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7

Fri, 25 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4
References

Tue, 22 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
References

Thu, 17 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
References

Thu, 17 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Els
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Vendors & Products Redhat jboss Enterprise Application Platform Els
References

Mon, 24 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7

Wed, 12 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
References

Tue, 11 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 11 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat build Of Apache Camel For Spring Boot
Redhat data Grid 8
Redhat fuse
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat single Sign On
Redhat undertow
Vendors & Products Redhat build Of Apache Camel For Spring Boot
Redhat data Grid 8
Redhat fuse
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat single Sign On
Redhat undertow

Tue, 11 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Important


Tue, 11 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
Title Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method
First Time appeared Redhat
Redhat camel Spring Boot
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat jbosseapxp
Redhat red Hat Single Sign On
Weaknesses CWE-120
CPEs cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat camel Spring Boot
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat jbosseapxp
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-08-11T08:49:58.552Z

Updated: 2026-10-21T09:30:37.179Z

Reserved: 2026-07-13T05:42:33.770Z

Link: CVE-2026-15565

cve-icon Vulnrichment

Updated: 2026-08-11T17:48:47.692Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T09:17:13.370

Modified: 2026-10-21T10:16:55.663

Link: CVE-2026-15565

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-11T05:55:42Z

Links: CVE-2026-15565 - Bugzilla