Bug 2455350 (CVE-2026-5680)

Summary:	CVE-2026-5680 undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abrianik, anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dhanak, dlofthou, drichtar, drosa, fmariani, ggrzybek, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jraez, jrokos, jwon, mcarlett, mnovotny, mosmerov, mposolda, msvehla, nwallace, parichar, pberan, pdelbell, pesilva, pjindal, pmackay, rhel-process-autobot, rmartinc, rstancel, rstepani, sausingh, security-response-team, smaestri, ssilvert, sthorger, tasato, tcunning, thjenkin, vdosoudi, vmuzikar, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2526161, 2526162
Bug Blocks:
Deadline:	2026-07-04

Description OSIDB Bzimport 2026-04-06 10:30:05 UTC

Summary:
Undertow’s PerMessageDeflateFunction.largerBuffer() uses exponential doubling

Requirements To Exploit:
Any application using Undertow’s WebSocket with permessage-deflate is

affected. This includes:

WildFly application server (uses Undertow as its web layer)

Red Hat JBoss Enterprise Application Platform (JBoss EAP)

Any standalone Undertow WebSocket application using

PerMessageDeflateHandshake

The vulnerability requires only a standard WebSocket connection with

permessage-deflate negotiated, no authentication, no special configuration.

Component Affected:
io.undertow:undertow-core

Version Affected:
Undertow 2.3.18.Final

Patch Available:
no

Version Fixed:
N/A

Cvss:
Score: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact:
IMPORTANT

Steps To Reproduce:
I have attached a self-contained Maven project (undertow-websocket-poc.tar.gz)

containing 6 tests:

Baselines:

Baseline 1a: Valid Origin -> upgrade accepted, message delivered

Baseline 1b: Invalid Origin -> HTTP 403 rejected

Mitigation:
Add a maxDecompressedBufferSize parameter to PerMessageDeflateHandshake

(e.g. default 10 MB) that limits the largerBuffer() growth

Add a maximum doubling count or absolute buffer cap in largerBuffer()

Add a maxDecompressionRatio check (reject if wire:decompressed > 100x)

Add a maxFragmentsPerMessage limit in WebSocketChannel

Add Ping rate limiting in WebSocketChannel before generating Pong

Expose these limits in the PerMessageDeflateHandshake constructor