CVE-2026-81624: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat build of Apache Camel for Spring Boot 4

Undertow, a web server used in JBoss EAP and WildFly, has a vulnerability due to the lack of configurable limits on WebSocket message buffer sizes and session timeouts. These defaults are unlimited, enabling remote attackers to consume excessive server resources by sending large data volumes or keeping connections open indefinitely. This resource exhaustion can crash the server, resulting in denial of service. The root cause is the absence of configuration options for WebSocket buffer sizes and timeouts during container boot. Red Hat has assessed this vulnerability as Important with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Successful exploitation allows a remote attacker to cause a denial of service by exhausting server memory or other resources through unlimited WebSocket connections and message buffers. There is no impact on confidentiality or integrity, but availability is severely affected.

According to the Red Hat advisory, no effective mitigation is currently available that meets their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for any future fixes or mitigations. Until a fix is released, risk remains due to the inability to limit resource consumption via configuration.