CVE-2026-5680 Undertow-core: undertow: denial of service via websocket permessage-deflate processing
Remote attackers can cause denial of service in Undertow by sending crafted WebSocket messages that trigger excessive memory consumption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5680?
CVE-2026-5680 is a high-severity denial of service vulnerability in Red Hat Data Grid 8, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.
Weakness: CWE-770
Which versions are affected by CVE-2026-5680?
How do I fix CVE-2026-5680?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-5680 being exploited?
There is no known exploitation of CVE-2026-5680 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-5680, GHSA-28vh-mg6p-gxg7, UBUNTU-CVE-2026-5680.