Threats Tagged 'cve-2026-15561'

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These issues affect various components including jackson-core, Netty, Bouncy Castle, jackson-databind, Undertow, Artemis, WildFly Elytron, Apache CXF, and others. The update replaces version 8.1.7 and is rated as having an important security impact. Users are advised to apply the update following Red Hat's guidance.

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing a range of vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These vulnerabilities affect components like jackson-core, Netty, Bouncy Castle, jackson-databind, Undertow, Artemis, Apache CXF, WildFly Elytron, and others. The update replaces version 8.1.7 and is intended to mitigate these issues in the platform based on WildFly runtime.

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These issues affect various components including Jackson libraries, Netty codecs, Bouncy Castle, Undertow, Apache CXF, Artemis server, WildFly Elytron, and others. The update replaces version 8.1.7 and is intended to mitigate these security risks.

CVE-2026-15561 is a vulnerability in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 involving the undertow HTTP/1.1 chunked-transfer decoder. The flaw allows an unauthenticated attacker to cause an OutOfMemory error by exploiting missing limits on size and count in chunked transfer decoding, resulting in denial of service by stopping all deployments on the listener. A security update fixing this issue is available in version 7.4.25.

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.