ZeroDay Findings
Sign inSign up

Findings

CVE-2026-15565

A flaw was found in Undertow.

Published Aug 11, 2026 · updated Oct 15, 2026

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 11, 2026 · NIST NVD

    Detected

    A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

  2. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

Sources

  • CVE.orgVulnerability recordCVE-2026-15565

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-15565

    A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a sta

    nvd.nist.gov

References