CVE-2026-15565 Denial of service in Red Hat Data Grid 8
Remote attackers can cause denial of service via memory exhaustion on unauthenticated WebSocket endpoints in Undertow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15565?
CVE-2026-15565 is a high-severity denial of service vulnerability in Red Hat Data Grid 8, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
Weakness: CWE-120
Which versions are affected by CVE-2026-15565?
How do I fix CVE-2026-15565?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-15565 being exploited?
There is no known exploitation of CVE-2026-15565 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-15565, GHSA-356w-cx4r-75hv, UBUNTU-CVE-2026-15565.