CVE-2026-15561: undertow
CVSS: 7.5v3.1HighAwaiting analysis
AliasesUBUNTU-CVE-2026-15561DEBIAN-CVE-2026-15561
Published 11-08-2026Last modified 16-10-2026
Vulnerability summary
CVE-2026-15561 is a high (CVSS 7.5) vulnerability in undertow. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.46%
0%100%
Low · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6Timeline
- 11-08-2026PublishedVulnerability first disclosed.
- 16-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.09 pp
From 0.37% on 18-09-2026
18-09-202618-10-2026
EPSS score0.46%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- undertowAll versions (No fix recorded)
Ubuntu1 product
- undertowAll versions (No fix recorded)
2 vendors · 2 products
