This vulnerability in Red Hat JBoss Enterprise Application Platform 7 involves the undertow HTTP/1.1 chunked-transfer decoder lacking proper limits on chunk size and count. An attacker can exploit this by sending crafted unauthenticated requests that cause the JVM to consume excessive memory, resulting in an OutOfMemory error. This leads to denial of service by halting all deployments on the affected listener. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 7.5, reflecting high severity due to network attack vector, low complexity, no privileges required, no user interaction, and high availability impact. No official patch or remediation level is currently confirmed by Red Hat, and affected versions are not explicitly stated. The vendor advisory is the authoritative source for updates.

Successful exploitation results in a denial of service condition by exhausting JVM memory resources, causing an OutOfMemory error that stops all deployments on the affected listener. There is no impact on confidentiality or integrity, but availability is severely affected.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15561 for current remediation guidance. No official fix or mitigation is currently documented. Users should monitor the vendor advisory for updates and apply patches once available.