CVE-2026-5680: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

The vulnerability exists in the Undertow component's handling of WebSocket messages when permessage-deflate compression is negotiated. The PerMessageDeflateFunction.largerBuffer() method uses exponential doubling to allocate buffer sizes without limits or throttling, which can be exploited by a remote attacker sending crafted messages to cause excessive memory consumption. This results in a Denial of Service (DoS) for the affected application. The issue is tracked as CVE-2026-5680 and affects Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10. The CVSS v3.1 score is 7.5 (High) with network attack vector, low complexity, no privileges or user interaction required, and high impact on availability.

Successful exploitation leads to excessive memory consumption on the affected system, causing a Denial of Service (DoS) condition. There is no impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction.

Red Hat advises configuring the PerMessageDeflateHandshake to limit the maximum decompressed buffer size by setting the maxDecompressedBufferSize parameter to a reasonable value (e.g., 10 MB) in the PerMessageDeflateHandshake constructor. This mitigates the vulnerability by preventing uncontrolled buffer growth. Applying this configuration change may require restarting the affected application or service. No official patch is explicitly stated in the advisory; therefore, check the Red Hat advisory for updates on patch availability.