CVE-2026-15562 is an integer overflow vulnerability in the MessageReader of the jboss-remoting component in Red Hat JBoss Enterprise Application Platform (EAP). A remote unauthenticated attacker who can reach ports 8080, 9990, or 4447 and complete an Upgrade: jboss-remoting handshake can trigger out-of-memory errors that degrade server performance and cause denial of service. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and impacts availability without affecting confidentiality or integrity. Red Hat has issued a security advisory and released a patch in JBoss EAP 7.4.25 to fix this flaw.

The vulnerability allows remote unauthenticated attackers to cause denial of service by triggering out-of-memory conditions on affected servers. This results in degraded request handling across the server, potentially causing crashes or service unavailability. There is no confidentiality or integrity impact reported. The CVSS score of 7.5 reflects a high impact on availability with no required privileges or user interaction.

Red Hat has released an official security update in Red Hat JBoss Enterprise Application Platform 7.4.25 that addresses this vulnerability. Users should apply this update to remediate the issue. Prior to updating, ensure all previous errata are applied and back up existing installations. No other mitigations or workarounds are specified in the advisory. Patch status is confirmed as fixed in version 7.4.25.