Undertow WebSocket flaw leaves Camel for Spring Boot exposed to remote denial of service

Red Hat has rated a newly mapped Undertow WebSocket vulnerability Important, with a CVSS 3.1 score of 7.5. CVE-2026-81624 lets an unauthenticated remote attacker consume enough memory or other server resources to crash an application, according to Red Hat Product Security.

The immediate product-level concern is Red Hat build of Apache Camel for Spring Boot 4. Red Hat’s affected-package table marks its undertow-core component as Affected and lists no security erratum. The same page says there is no mitigation that meets Red Hat’s criteria for ease of deployment, broad applicability and stability.

What changed

The problem sits in Undertow’s WebSocket container startup path. Red Hat says operators cannot adjust certain limits, including message-buffer sizes and session timeouts, so those controls default to unlimited values. A network attacker needs no privileges or user interaction and can send large volumes of data or hold connections open indefinitely. The resulting resource exhaustion has high availability impact but no listed confidentiality or integrity impact.

Red Hat says the CVE became public on Aug. 27 and last modified its product assessment on Aug. 31. Its current table also marks Undertow in Red Hat Fuse 7 and JBoss EAP 7 as Will not fix, while several RHEL RESTEasy or Moditect packages are listed as not affected because the vulnerable code is not in the execution path.

Who is affected

Teams running Red Hat build of Apache Camel for Spring Boot 4 with Undertow should treat externally reachable WebSocket endpoints as the primary exposure. The CVSS vector is network-accessible, low-complexity and unauthenticated, which makes availability-focused abuse practical wherever an endpoint can be reached.

Users of older Fuse 7 or JBoss EAP 7 deployments should also review the product table carefully. “Will not fix” is a lifecycle and remediation signal, not a statement that the vulnerable code is harmless.

What to do

There is no Red Hat erratum or accepted mitigation on the CVE page at the time of writing. Platform and application teams should inventory Undertow-backed WebSocket services, limit their network exposure using controls outside Undertow where feasible, and monitor connection counts, memory consumption and abnormal long-lived sessions.

The operational next step is to watch Red Hat’s CVE record for product-state changes and errata. Because the page warns that older package versions in listed products should be assumed vulnerable unless explicitly marked otherwise, teams should not infer safety from the absence of a row for a particular minor stream.