The CVSS 7.5 rating for this Undertow WebSocket memory exhaustion vulnerability masks a more nuanced operational reality. The EPSS score of 0.00379 reflects the actual probability of active exploitation — and for good reason. This is not a traditional RCE or injection flaw; it requires an attacker to maintain thousands of concurrent WebSocket connections to a single endpoint, holding them open long enough to exhaust heap memory. This is a noisy, resource-intensive attack that is functionally indistinguishable from a legitimate popular application at the network layer.
The practical implication is that connection-limit tuning in Undertow's listener configuration is the primary mitigation, not a code patch. Set max-connections-per-session and configure appropriate buffer sizes for @OnMessage handlers. This is well-documented but non-obvious — the API makes unbounded memory accumulation the path of least resistance.
What the CVSS/EPSS gap actually measures is the difference between technical severity and operational exploitability — but there's a third dimension the scores miss: the persistent blast radius. When this OOM triggers, it takes down every microservice sharing the JVM, not just the WebSocket endpoint. Attribution in postmortems typically goes to connection pools or OOM killer thresholds, not Undertow session management, meaning the vulnerability accrues blame invisibly.
The 2026 date is almost certainly a placeholder. Treat this as active. Audit any @ServerEndpoint with @OnMessage handlers in your Undertow deployments for connection limit configuration, and treat the absence of such limits as the equivalent of an unpatched vulnerability — because the vulnerable pattern (stateful WebSocket sessions accumulating in heap) ships forward in dependencies and cloned code long after the CVE fades from attention.