Threats Tagged 'cve-2026-15565'

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These issues affect various components including jackson-core, Netty, Bouncy Castle, jackson-databind, Undertow, Artemis, WildFly Elytron, Apache CXF, and others. The update replaces version 8.1.7 and is rated as having an important security impact. Users are advised to apply the update following Red Hat's guidance.

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing a range of vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These vulnerabilities affect components like jackson-core, Netty, Bouncy Castle, jackson-databind, Undertow, Artemis, Apache CXF, WildFly Elytron, and others. The update replaces version 8.1.7 and is intended to mitigate these issues in the platform based on WildFly runtime.

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These issues affect various components including Jackson libraries, Netty codecs, Bouncy Castle, Undertow, Apache CXF, Artemis server, WildFly Elytron, and others. The update replaces version 8.1.7 and is intended to mitigate these security risks.

CVE-2026-15565 is a denial of service vulnerability in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7. It arises from a flaw in the Undertow component where a remote attacker can cause an out-of-memory condition on a WebSocket endpoint without authentication, specifically targeting any @ServerEndpoint class with an @OnMessage method. This vulnerability allows unauthenticated attackers to disrupt service availability using only a standard WebSocket handshake. A security update addressing this issue is available in Red Hat JBoss Enterprise Application Platform 7.4.25.

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.