RHSA-2026:53806Vendor advisory
https://access.redhat.com/errata/RHSA-2026:53806 CVE-2026-15567
HIGH
Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener
Record summary
CVE-2026-15567 has a selected CVSS score of 7.5 (high).
Description
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List
Affected products and versions
5| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unknown | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform 7.4.25Browse Red Hat / Red Hat JBoss Enterprise Application Platform 7.4.25wildfly-iiop-openjdkDefault status: unaffected | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform 8Browse Red Hat / Red Hat JBoss Enterprise Application Platform 8wildfly-iiop-openjdkDefault status: affected | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform Expansion PackBrowse Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Packwildfly-iiop-openjdkDefault status: unaffected | CVE List | Version data not supplied | |
Default status: unknown | CVE List | Version data not supplied | |
References
4access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-15567 RHBZ#2491620issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2491620 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-15567