Summary
CVE-2026-15565 is a pre-authentication denial-of-service vulnerability in Red Hat Undertow’s WebSocket implementation. An unauthenticated remote attacker can cause an Out of Memory condition against any @ServerEndpoint class that defines an @OnMessage method, resulting in service unavailability. Red Hat rates the flaw as Important with a CVSS v3.1 base score of 7.5 (High).
Technical details
- Root cause: Improper memory handling in Undertow’s WebSocket message processing (CWE-120, Buffer Copy without Checking Size of Input), affecting endpoints annotated with
@ServerEndpointand containing an@OnMessagemethod. - Trigger conditions: An attacker interacts with an affected WebSocket endpoint via a standard WebSocket handshake; no authentication, privileges, or user interaction are required.
- Attack vector: Network (remote, unauthenticated).
- Impact: Memory exhaustion (Out of Memory) leading to denial of service. There is no impact to confidentiality or integrity; the impact is limited to availability.
Affected software
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform 7 and 8
- Red Hat Fuse 7
- Red Hat Single Sign-On 7
Severity
- CVSS v3.1 base score: 7.5 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Mitigation and recommended actions
- Immediate: Apply the fixed packages published by Red Hat for the affected products as they become available; consult the Red Hat security advisory for per-product update status.
- If no patch is available, workarounds:
- Disable WebSockets server-wide by removing
<websockets/>from the servlet-container configuration instandalone.xml. - Disable WebSockets per-application by adding
<enable-websockets>false</enable-websockets>toWEB-INF/jboss-web.xml.
- Disable WebSockets server-wide by removing

