Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-15567

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25

    Version range not reported

  • eap7-activemq-artemis

    Version range not reported

  • eap7-glassfish-jsf

    Version range not reported

  • eap7-ironjacamar

    Version range not reported

  • eap7-jackson-annotations

    Version range not reported

  • eap7-jackson-core

    Version range not reported

  • eap7-jackson-databind

    Version range not reported

  • eap7-jackson-jaxrs-providers

    Version range not reported

  • eap7-jackson-modules-base

    Version range not reported

  • eap7-jackson-modules-java8

    Version range not reported

  • eap7-jboss-remoting

    Version range not reported

  • eap7-jboss-server-migration

    Version range not reported

  • eap7-netty

    Version range not reported

  • eap7-netty-transport-native-epoll

    Version range not reported

  • eap7-picketlink-bindings

    Version range not reported

  • eap7-picketlink-federation

    Version range not reported

  • eap7-undertow

    Version range not reported

  • eap7-wildfly

    Version range not reported

  • eap7-activemq-artemis

    Version range not reported

  • eap7-glassfish-jsf

    Version range not reported

  • eap7-ironjacamar

    Version range not reported

  • eap7-jackson-annotations

    Version range not reported

  • eap7-jackson-core

    Version range not reported

  • eap7-jackson-databind

    Version range not reported

  • eap7-jackson-jaxrs-providers

    Version range not reported

  • eap7-jackson-modules-base

    Version range not reported

  • eap7-jackson-modules-java8

    Version range not reported

  • eap7-jboss-remoting

    Version range not reported

  • eap7-jboss-server-migration

    Version range not reported

  • eap7-netty

    Version range not reported

  • eap7-netty-transport-native-epoll

    Version range not reported

  • eap7-picketlink-bindings

    Version range not reported

  • eap7-picketlink-federation

    Version range not reported

  • eap7-undertow

    Version range not reported

  • eap7-wildfly

    Version range not reported

  • eap7-activemq-artemis

    Version range not reported

  • eap7-glassfish-jsf

    Version range not reported

  • eap7-ironjacamar

    Version range not reported

  • eap7-jackson-annotations

    Version range not reported

  • eap7-jackson-core

    Version range not reported

  • eap7-jackson-databind

    Version range not reported

  • eap7-jackson-jaxrs-providers

    Version range not reported

  • eap7-jackson-modules-base

    Version range not reported

  • eap7-jackson-modules-java8

    Version range not reported

  • eap7-jboss-remoting

    Version range not reported

  • eap7-jboss-server-migration

    Version range not reported

  • eap7-netty

    Version range not reported

  • eap7-netty-transport-native-epoll

    Version range not reported

  • eap7-picketlink-bindings

    Version range not reported

  • eap7-picketlink-federation

    Version range not reported

  • eap7-undertow

    Version range not reported

  • eap7-wildfly

    Version range not reported

  • org.jboss.eap/wildfly-iiop-openjdk

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • wildfly-iiop-openjdk

    Version range not reported

  • wildfly-iiop-openjdk

    Version range not reported

  • wildfly-iiop-openjdk

    Version range not reported

  • wildfly-iiop-openjdk

    Version range not reported

References 10

access.redhat.com

bugzilla.redhat.com