The vulnerability CVE-2026-15567 in Wildfly, used by Red Hat Fuse 7, allows a remote unauthenticated attacker to trigger an OutOfMemoryError. This happens because the CSIv2Util's GSS token decoder processes an attacker-controlled length field without bounds checking, leading to an attempt to allocate a byte array of arbitrary size. The flaw results in a denial of service by exhausting memory resources. The CVSS v3.1 score is 7.5 (high), with network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Red Hat’s advisory does not specify affected versions or provide a patch or workaround at this time. The vulnerability is under investigation with no known exploits in the wild.

The impact is a denial of service condition caused by an OutOfMemoryError triggered remotely without authentication. There is no impact on confidentiality or integrity. The availability of the affected system can be disrupted, potentially causing service outages.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15567 for current remediation guidance. No official fix or workaround is currently documented. Users should monitor the vendor advisory for updates and consider applying mitigations if provided in the future.