EUVD-2026-55929
GHSA-g28c-9r5g-f43w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
PR:H confirmed by admin-only access requirement; I:L added because malformed payload permanently corrupts standalone.xml, constituting a minor integrity impact the vendor vector omits.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.
AnalysisAI
Denial of service in WildFly Core (and downstream Red Hat middleware products) allows a remote administrative user to render a server permanently unrecoverable by injecting a malformed payload into the Inet Address field of the Management Model. The injected payload is persisted to standalone.xml, corrupting the configuration file and preventing normal server restart without manual intervention. No public exploit code has been identified at time of analysis, and the vulnerability is limited to users with administrative credentials, reducing its real-world blast radius despite the high availability impact.
Technical ContextAI
WildFly Core is the foundational management and runtime layer underlying Red Hat JBoss Enterprise Application Platform (EAP 7 and 8), Red Hat Fuse 7, Red Hat Process Automation 7, and Red Hat Single Sign-On 7. The Management Model exposes an HTTP/HTTPS management API through which administrators configure server resources, including network interface bindings via the Inet Address field. CWE-91 (XML Injection) is the root cause: the Inet Address field does not properly sanitize or validate input before serializing it into the XML-based standalone.xml configuration file. A crafted value - likely containing characters that are syntactically valid at the API layer but malformed as XML content - survives input handling and is written to disk. On next read (or immediately upon processing), the corrupted XML causes an unhandled parse failure, crashing the server and leaving the configuration unreadable. Recovery requires out-of-band file system access to manually edit or restore standalone.xml.
RemediationAI
Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-24329 for product-specific patched versions across JBoss EAP 7, EAP 8, Fuse 7, Process Automation 7, and SSO 7 - no exact fix version is confirmed in available data, so treat vendor guidance as authoritative. As a compensating control, restrict network access to the WildFly Management API (default ports 9990/9993) to a tightly scoped allowlist of trusted admin hosts using firewall rules or network segmentation; this prevents remote exploitation while preserving local management capability, with the trade-off that remote administration is disrupted. Additionally, enforce multi-factor authentication and role-based access control on administrative accounts to reduce the risk of credential compromise enabling this attack. In containerized or cloud deployments where file system access is limited, establish a tested procedure for restoring standalone.xml from a known-good backup before any patch is applied, as recovery otherwise requires out-of-band intervention.
More in Red Hat Fuse 7
View allHTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted ima
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers e
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned a
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the sec
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a refer
Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today