EUVD-2026-55986
GHSA-r89v-33gc-39f6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated handshake with no complexity barrier; impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.
AnalysisAI
Denial of service in Red Hat JBoss Enterprise Application Platform's jboss-remoting component allows any remote unauthenticated attacker who can reach application or management ports to exhaust server memory through a crafted protocol handshake. By completing an Upgrade: jboss-remoting handshake on ports 8080, 9990, or 4447, an attacker triggers an integer overflow (CWE-190) that causes uncontrolled heap allocation, inducing OOM errors that degrade or halt request processing server-wide. No public exploit has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The jboss-remoting library implements Red Hat's proprietary binary remoting protocol, used by JBoss EAP for intra-cluster communication, remote EJB calls, JMS messaging, and CLI management. The Upgrade mechanism mirrors HTTP's connection-upgrade path - analogous to WebSocket upgrades - allowing an HTTP/1.1 connection on port 8080 or 9990 to be switched to the binary remoting protocol; port 4447 serves the legacy remoting endpoint directly. CWE-190 (Integer Overflow or Wraparound) identifies the root cause class: during handshake processing, an integer computation wraps or overflows in a way that instructs the JVM to allocate a disproportionately large memory buffer, rapidly consuming heap space. Critically, this entire code path executes before any authentication exchange, so no credentials are required. The jboss-remoting subsystem is a foundational component of EAP, making OOM conditions in this layer cascade across all active server threads rather than being isolated to a single application.
RemediationAI
The primary remediation is to apply the vendor-supplied patch once made available; patch availability and the exact fixed version must be confirmed directly from the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15562 and the Bugzilla issue at https://bugzilla.redhat.com/show_bug.cgi?id=2483135, as an exact fix version was not confirmed in the available intelligence data. While awaiting a patch, the most effective compensating control is to restrict network access to ports 8080, 9990, and 4447 using host-based firewall rules or perimeter ACLs, limiting inbound connections to only trusted source addresses such as administrative workstations, load balancers, or cluster peers - this eliminates the unauthenticated exposure surface without requiring application changes. If the jboss-remoting subsystem and remote EJB or CLI capabilities are not operationally required, disabling the subsystem entirely removes the vulnerable handshake path, though this will break remote management and clustering features that depend on it. For environments where port 9990 must remain accessible, placing a VPN or authenticated reverse proxy in front of the management interface prevents unauthenticated handshake attempts from reaching the vulnerable code path. Do not assume patch availability based solely on this analysis; verify with Red Hat directly.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today