CyberRota Analysis
AI-GeneratedA vulnerability exists in Undertow, a web server utilized in JBoss EAP and WildFly, where improper handling of WebSocket connections allows for unlimited message buffer sizes and session timeouts. This flaw enables remote attackers to overwhelm the server with excessive data or maintain persistent connections, risking server crashes due to resource exhaustion. Organizations using JBoss EAP or WildFly should prioritize addressing this issue to safeguard against potential denial-of-service attacks.
Original NVD Description
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.