CVE-2026-5680
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.
- Published Aug 27, 2026
- CVSS 7.5 high
- 1.1% chance of exploitation in the next 30 days (EPSS)
- A fix is available