This vulnerability involves an integer overflow or wraparound in the MessageReader of the jboss-remoting component in Red Hat JBoss Enterprise Application Platform 7. An attacker remotely connecting to ports 8080, 9990, or 4447 and completing an Upgrade: jboss-remoting handshake can cause excessive memory allocation resulting in out-of-memory errors. This resource exhaustion degrades server-wide request handling, causing denial of service. The vulnerability is pre-authentication and requires no privileges or user interaction. The CVSS v3.1 base score is 7.5 with a high impact on availability and no impact on confidentiality or integrity. Red Hat has published an advisory but has not confirmed a remediation level or patch availability yet.

The vulnerability allows a remote unauthenticated attacker to cause out-of-memory errors on the affected server by exploiting an integer overflow in the jboss-remoting MessageReader. This results in denial of service by degrading the ability of the server to handle requests. There is no impact on confidentiality or integrity. The attack surface includes network access to ports 8080, 9990, or 4447. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15562 for current remediation guidance. Until a fix is available, consider restricting network access to the affected ports (:8080, :9990, :4447) to trusted sources to reduce exposure. No vendor-provided mitigations or workarounds are currently documented.