This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-15561 →
UBUNTU-CVE-2026-15561
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticat...
Original description
The description as published by the source.
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:16.04:LTS
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:22.04:LTS
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:24.04:LTS
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org
- report bugzilla.redhat.com
- report access.redhat.com
- report access.redhat.com
- report access.redhat.com