CVE-2026-81624: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat build of Apache Camel for Spring Boot 4

The vulnerability CVE-2026-81624 affects Undertow, a web server used in Red Hat's build of Apache Camel for Spring Boot 4. The issue arises because certain configuration parameters related to WebSocket connections—specifically message buffer sizes and session timeouts—are not configurable and default to unlimited values. This lack of limits enables a remote attacker to consume excessive server resources, leading to potential denial of service through resource exhaustion. The root cause is the absence of configuration options for these WebSocket parameters during the container boot process. Red Hat has assessed this vulnerability as Important (high severity) with a CVSS v3.1 base score of 7.5, primarily due to the high availability impact. No official patch or mitigation meeting Red Hat's criteria is currently available.

Successful exploitation allows a remote attacker to cause a denial of service by exhausting server resources such as memory or CPU through unlimited WebSocket connections or large message buffers. There is no impact on confidentiality or integrity. The vulnerability affects availability by potentially crashing the server or making it unresponsive.

According to the Red Hat advisory, no mitigation is currently available that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates or fixes. No official patch has been released yet. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.