ZeroDay Findings
Sign inSign up

Findings

CVE-2026-15561

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder.

Published Aug 11, 2026 · updated Oct 15, 2026

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 11, 2026 · NIST NVD

    Detected

    A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

  2. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

Sources

  • CVE.orgVulnerability recordCVE-2026-15561

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-15561

    A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

    nvd.nist.gov

References