A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an… (CVE-2026-15567)
A vulnerability in Wildfly allows a remote unauthenticated attacker to cause an OutOfMemoryError by exploiting improper bounds checking in the CSIv2Util's GSS token decoder. The flaw involves reading an attacker-controlled length field without validation, leading to excessive memory allocation attempts and denial of service. This issue affects Red Hat JBoss Enterprise Application Platform 7.4.25 and earlier versions. A security update has been released by Red Hat to address this vulnerability.
AI Analysis
Technical Summary
CVE-2026-15567 is a denial of service vulnerability in Wildfly's CSIv2Util component where the GSS token decoder reads an attacker-controlled length field without bounds checking. This causes the system to attempt to allocate a byte array of an unbounded size, resulting in an OutOfMemoryError. The vulnerability can be triggered remotely without authentication. Red Hat has issued a security update for JBoss Enterprise Application Platform 7.4.25 that fixes this issue.
Potential Impact
The vulnerability allows a remote unauthenticated attacker to cause a denial of service by exhausting memory resources, leading to an OutOfMemoryError and potential service disruption. There is no impact on confidentiality or integrity, but availability is severely affected.
Mitigation Recommendations
An official security update is available from Red Hat for JBoss Enterprise Application Platform 7.4.25 that addresses this vulnerability. Users should apply this update to remediate the issue. Prior to updating, ensure all previous errata are applied and back up existing installations. No other mitigations are specified by the vendor.
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an… (CVE-2026-15567)
Description
A vulnerability in Wildfly allows a remote unauthenticated attacker to cause an OutOfMemoryError by exploiting improper bounds checking in the CSIv2Util's GSS token decoder. The flaw involves reading an attacker-controlled length field without validation, leading to excessive memory allocation attempts and denial of service. This issue affects Red Hat JBoss Enterprise Application Platform 7.4.25 and earlier versions. A security update has been released by Red Hat to address this vulnerability.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15567 is a denial of service vulnerability in Wildfly's CSIv2Util component where the GSS token decoder reads an attacker-controlled length field without bounds checking. This causes the system to attempt to allocate a byte array of an unbounded size, resulting in an OutOfMemoryError. The vulnerability can be triggered remotely without authentication. Red Hat has issued a security update for JBoss Enterprise Application Platform 7.4.25 that fixes this issue.
Potential Impact
The vulnerability allows a remote unauthenticated attacker to cause a denial of service by exhausting memory resources, leading to an OutOfMemoryError and potential service disruption. There is no impact on confidentiality or integrity, but availability is severely affected.
Mitigation Recommendations
An official security update is available from Red Hat for JBoss Enterprise Application Platform 7.4.25 that addresses this vulnerability. Users should apply this update to remediate the issue. Prior to updating, ensure all previous errata are applied and back up existing installations. No other mitigations are specified by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h33j-vrhg-4q7j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-15567"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Patch Information
Threat ID: 6a7cd3f2bf8831d539180a46
Added to database: 08/12/2026, 20:13:38 UTC
Last enriched: 08/12/2026, 20:27:06 UTC
Last updated: 08/13/2026, 02:40:59 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.