CVE-2026-15561

A vulnerability exists in EAP's undertow HTTP/1.1 chunked-transfer decoder, which lacks proper limits on size and count. This flaw can be exploited by an attacker to trigger an OutOfMemory error in the JVM through an unauthenticated connection, resulting in a Denial of Service that halts all deployments on the listener. Organizations using affected EAP products should prioritize addressing this issue to prevent potential service disruptions.