CVE-2026-81624

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 31, 2026
Last modified
Sep 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-816258.8A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger aCVE-2026-816268.6IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated uCVE-2026-816278.2A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the optiCVE-2026-81638.8The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statementCVE-2026-816308.1The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmwarCVE-2026-816327.2Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access loCVE-2026-816336.9Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query witCVE-2026-816347.5In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow durinCVE-2026-816355.1A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of aCVE-2026-816368.7Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass theCVE-2026-816372.3Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state valueCVE-2026-816382.1Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string s