CVE-2016-9589: Red Hat Wildfly DoS
Summary
CVE-2016-9589: Red Hat Wildfly DoS. Affects org.wildfly:wildfly-undertow versions < 11.0.0.Beta1. Fixed in 11.0.0.Beta1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Red Hat Wildfly is an open-source Java application server that provides a platform for building and deploying enterprise Java applications. It utilizes the Undertow web server component for handling HTTP requests. Undertow keeps a cache of seen HTTP headers in persistent connections. This cache can be exploited to exhaust system resources, leading to a denial of service (DoS) attack. The vulnerability exists in versions prior to 11.0.0.Beta1.
Vulnerability Detail
The vulnerability in Red Hat Wildfly allows an attacker to exploit the cache of seen HTTP headers in persistent connections, causing a resource exhaustion issue. By sending a large number of specially crafted HTTP headers, an attacker can fill the server's memory with garbage data. This can lead to a denial of service, as the server becomes unresponsive or crashes. The maximum amount of memory that can be consumed per active TCP connection is determined by the product of the 'max-headers' (default 200) and 'max-header-size' (default 1MB) configuration settings.
How To Fix
Latest published version: 42.0.0.Final as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.0.Beta1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by upgrading to a patched version of Red Hat Wildfly.
Conclusion
The vulnerability in Red Hat Wildfly allows an attacker to launch a denial of service attack by exploiting the cache of seen HTTP headers in persistent connections. To mitigate this vulnerability, it is recommended to upgrade to a patched version of Red Hat Wildfly. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.wildfly:wildfly-undertow →
FAQ
The vulnerability allows an attacker to launch a denial of service attack by exhausting system resources. This can result in the server becoming unresponsive or crashing, leading to service disruption.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
No, authentication is not required to exploit this vulnerability. An attacker can send specially crafted HTTP headers to exploit the cache and cause resource exhaustion.
The only known mitigation is to upgrade to a patched version of Red Hat Wildfly that includes the fix for this vulnerability.
Yes, this vulnerability can be exploited remotely. An attacker can send malicious HTTP headers to the server over the network to trigger the resource exhaustion issue.
Related vulnerabilities
Recent vulnerabilities recorded for org.wildfly:wildfly-undertow.
