CVE-2026-81624: Resource Exhaustion in Undertow WebSocket Implementation

CVE-2026-81624 is a resource exhaustion vulnerability affecting the Undertow web server, a core component of JBoss EAP and WildFly. The flaw arises because the implementation fails to enforce configurable limits on WebSocket message buffer sizes and session timeouts, defaulting these settings to be effectively unlimited. A remote, unauthenticated attacker can exploit this by opening and maintaining an excessive number of WebSocket connections or by flooding the server with large data payloads. By keeping these connections alive indefinitely or consuming available memory through buffer saturation, an attacker can trigger a denial of service (DoS), rendering the server unresponsive to legitimate requests. Given its role in enterprise application servers, this vulnerability represents a significant risk for organizations relying on Java-based middleware to handle high-concurrency traffic.

Impact

Successful exploitation results in denial of service, potentially causing system crashes and service unavailability for applications hosted on JBoss EAP or WildFly. This impacts availability of web-based services and administrative interfaces, forcing a restart of the application server to restore functionality.

Recommendation

Prioritize auditing your infrastructure to identify JBoss EAP and WildFly instances exposing WebSocket endpoints to the internet. Since specific patch or configuration guidance is pending, monitor application server logs for abnormal patterns of WebSocket connection persistence or high memory consumption. Disable WebSocket functionality for services where it is not business-critical to minimize the attack surface.