CVE-2026-15561: Undertow-core: oom via missing limits in chunked trailer in eap's undertow

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-11-01
Weakness: CWE-770

Description

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

Affected products

Red Hat JBoss Enterprise Application Platform 7: all versions
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7: all versions — fixed in 0:2.16.0-22.redhat_00057.1.el7eap
Red Hat JBoss Enterprise Application Platform 8.1.8.GA: all versions — fixed in 2.3.26.SP3-redhat-00001
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10: all versions — fixed in 0:2.40.0-8.redhat_00024.1.el10eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: all versions — fixed in 0:2.40.0-8.redhat_00024.1.el8eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: all versions — fixed in 0:2.40.0-8.redhat_00024.1.el9eap

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.16.0-22.redhat_00057.1.el7eap; Red Hat JBoss Enterprise Application Platform 8.1.8.GA 2.3.26.SP3-redhat-00001; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:2.40.0-8.redhat_00024.1.el10eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:2.40.0-8.redhat_00024.1.el8eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:2.40.0-8.redhat_00024.1.el9eap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-15561 or the next vulnerability affects your stack