CVE-2026-15561 Undertow-core: oom via missing limits in chunked trailer in eap's undertow
An unauthenticated attacker can cause a Denial of Service by triggering an OutOfMemory error in the Undertow chunked-transfer decoder due to missing limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15561?
CVE-2026-15561 is a high-severity denial of service vulnerability in Red Hat JBoss Enterprise Application Platform 7, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
Weakness: CWE-770
Which versions are affected by CVE-2026-15561?
How do I fix CVE-2026-15561?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-15561 being exploited?
There is no known exploitation of CVE-2026-15561 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-15561, GHSA-fhmg-q5fc-2m8v, UBUNTU-CVE-2026-15561.