Skip to content
Sign in
7.5 High

CVE-2026-15562 Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service

Description

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected products and versions

Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4.25 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Versions not published
Show the 3 other branches
Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1.8.GA 5.0 earliest → < 5.0.31.SP2-redhat-00001 5.0.31.SP2-redhat-00001

Other CVEs of Red Hat JBoss Enterprise Application Platform 7

The 168 CVEs of Red Hat JBoss Enterprise Application Platform 7 →
CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow 6.5 Medium CVE-2026-114488 A flaw was found in Wildfly 7.4 High
Track this CVE