CVE-2026-5680

Undertow (specifically the Undertow-core component) is vulnerable to a Denial of Service (DoS) attack exploitable over the network without authentication. A remote attacker can send specially crafted WebSocket messages with the permessage-deflate extension negotiated, triggering excessive memory ...