RHSA-2026:53806Vendor advisory
https://access.redhat.com/errata/RHSA-2026:53806 CVE-2026-15565
HIGH
Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method
Record summary
CVE-2026-15565 has a selected CVSS score of 7.5 (high).
Description
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List
Affected products and versions
7| Product | Source | Version range | Status |
|---|---|---|---|
Default status: affected | CVE List | Version data not supplied | |
Default status: unknown | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform 7.4.25Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4.25undertow-websockets-jsrDefault status: unaffected | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform 8Browse Red Hat / Red Hat JBoss Enterprise Application Platform 8undertow-websockets-jsrDefault status: affected | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform Expansion PackBrowse Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Packundertow-websockets-jsrDefault status: unaffected | CVE List | Version data not supplied | |
Default status: unknown | CVE List | Version data not supplied | |
Red Hat build of Apache Camel for Spring Boot 4Browse Red Hat / Red Hat build of Apache Camel for Spring Boot 4undertow-websockets-jsrDefault status: affected | CVE List | Version data not supplied | |
References
4access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-15565 RHBZ#2490628issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2490628 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-15565