Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-5680

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • io.undertow/undertow-core

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • moditect

    Version range not reported

  • pki-core:10.6/resteasy

    Version range not reported

  • pki-deps:10.6/resteasy

    Version range not reported

  • resteasy

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core-2.3.10.Final.jar

    Version range not reported

  • undertow-core-2.3.18.Final.jar

    Version range not reported

  • undertow-core-2.3.23.SP3-redhat-00001.jar

    Version range not reported

  • undertow-core

    Version range not reported

  • undertow-core

    Version range not reported

References 6

access.redhat.com

bugzilla.redhat.com