The vulnerability in Undertow allows a remote attacker to trigger an out‑of‑memory condition on any WebSocket endpoint that is implemented with a @ServerEndpoint class containing at least one @OnMessage handler. The defect permits the attacker to send a standard WebSocket handshake request that is authenticated as an unauthenticated user, leading the server to consume increasingly large amounts of memory and ultimately causing a denial of service. The weakness corresponds to CWE‑120, indicating a buffer handling error that can be exploited to exhaust resources.

Affected products include Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8, the JBoss EAP Expansion Pack, Red Hat Single Sign‑On 7, and Red Hat builds of Apache Camel for Spring Boot 4. No specific version ranges are listed, so any deployment that incorporates Undertow and utilizes @ServerEndpoint/@OnMessage classes is potentially vulnerable.

The CVSS base score of 7.5 classifies the issue as high severity, and the vulnerability is not listed in the KEV catalog, though no EPSS data is available. An attacker can exploit it from the network without authentication or privileges by establishing a normal WebSocket connection; the attack would not require any special knowledge beyond knowledge of the endpoint URL. Because the mitigations are purely server configuration changes or a patch, the risk is significant in environments where web services are publicly exposed.