CVE-2026-15565 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for Undertow-based applications, especially those using websockets, should be aware of this vulnerability and take appropriate defensive actions. This includes reviewing and applying vendor remediation, implementing compensating controls, and monitoring for suspicious websocket traffic. Additionally, operators of platforms that utilize Undertow for websocket functionality should assess their exposure and prioritize remediation efforts based on the potential impact of a Denial of Service attack.

Technical summary

CVE-2026-15565 is a vulnerability in the Undertow server that allows a remote attacker to cause an Out of Memory condition on websockets endpoints without authentication. This can lead to a Denial of Service attack. The vulnerability exists in any @ServerEndpoint class that has any @OnMessage method. The CVSS score for this vulnerability is 7.5, indicating a high severity. Affected systems include those using Undertow with websockets enabled, particularly in configurations where remote access to websocket endpoints is possible.

Defensive priority

This vulnerability allows a remote attacker to cause a Denial of Service attack without authentication, making it a high-priority issue for systems using Undertow with websockets enabled.

Recommended defensive actions

• Review and apply vendor remediation if available
• Implement compensating controls such as rate limiting on websocket connections
• Monitor for and restrict suspicious websocket traffic
• Inventory and assess exposure of Undertow-based applications
• Consider temporarily disabling websockets if not required

Evidence notes

The CVE-2026-15565 record indicates a flaw in Undertow that allows a remote attacker to cause an Out of Memory condition on websockets endpoints without authentication. Evidence from Redhat suggests potential impact on Undertow-based applications, particularly those utilizing websockets. However, specific affected products and versions are not clearly identified in the provided sources. Defenders should verify websocket usage in their environments, assess the potential impact, and monitor for suspicious websocket traffic. Additionally, they should review vendor advisories and apply patches if available.

Official resources