CVE-2026-15561

Undertow-core: oom via missing limits in chunked trailer in eap's undertow

Published Aug 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

Remediation

Vendor Workaround

Deploy a re-framing layer-7 reverse proxy such as nginx, HAProxy in http mode, or an AWS Application Load Balancer in front of the affected JBoss EAP listener. Because such a proxy terminates and re-frames the HTTP/1.1 chunked request, an oversized chunked trailer cannot be passed through to Undertow, which fully mitigates this issue. Direct-edge and layer-4/TCP load-balanced deployments lack this protection; for those deployments, no other workaround meeting Red Hat Product Security criteria is available, and the fixes being delivered for the affected EAP streams should be applied when released.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
References
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Els
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Vendors & Products Redhat jboss Enterprise Application Platform Els
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Expansion Pack
Vendors & Products Redhat jboss Enterprise Application Platform Expansion Pack
Type Values Removed Values Added
Description A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
Title Undertow-core: oom via missing limits in chunked trailer in eap's undertow
First Time appeared Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Weaknesses CWE-770
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
Vendors & Products Redhat
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 1, 2026, 12:11 AM
Reserved
Jul 13, 2026, 5:08 AM
Status
Awaiting Analysis
Published
Aug 11, 2026, 9:17 AM
Modified
Nov 1, 2026, 1:17 AM
Severity
Important
Public date
Aug 11, 2026, 5:52 AM