Record summary

CVE-2026-15565 has a selected CVSS score of 7.5 (high).

Description

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

7
ProductSourceVersion rangeStatus

Red Hat Data Grid 8

Browse Red Hat / Red Hat Data Grid 8undertow-websockets-jsr

Default status: affected

CVE ListVersion data not supplied

Red Hat Fuse 7

Browse Red Hat / Red Hat Fuse 7undertow-websockets-jsr

Default status: unknown

CVE ListVersion data not supplied

Red Hat JBoss Enterprise Application Platform 7.4.25

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4.25undertow-websockets-jsr

Default status: unaffected

CVE ListVersion data not supplied

Red Hat JBoss Enterprise Application Platform 8

Browse Red Hat / Red Hat JBoss Enterprise Application Platform 8undertow-websockets-jsr

Default status: affected

CVE ListVersion data not supplied

Red Hat JBoss Enterprise Application Platform Expansion Pack

Browse Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Packundertow-websockets-jsr

Default status: unaffected

CVE ListVersion data not supplied

Red Hat Single Sign-On 7

Browse Red Hat / Red Hat Single Sign-On 7undertow-websockets-jsr

Default status: unknown

CVE ListVersion data not supplied

Red Hat build of Apache Camel for Spring Boot 4

Browse Red Hat / Red Hat build of Apache Camel for Spring Boot 4undertow-websockets-jsr

Default status: affected

CVE ListVersion data not supplied

References

4