CVE-2026-15565

HighCVSS 7.5/10Last modified Oct 21, 2026

Description

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 21, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-155677.5A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attack CVE-2026-15577.5The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parame CVE-2026-155707.1An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV r CVE-2026-155717.3A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access manageme CVE-2026-155728.8A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, whi CVE-2026-155738.1A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatche CVE-2026-155747.5A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full CVE-2026-155755.3Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Co CVE-2026-155766.9Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client cer CVE-2026-155776.5A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its s CVE-2026-155798.8An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length dur CVE-2026-15585.3The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.