What is the CVSS score of EUVD-2026-55989?

EUVD-2026-55989 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of WildFly are affected by EUVD-2026-55989?

WildFly application servers face a critical denial-of-service vulnerability in the GSS token decoder that permits remote, unauthenticated attackers to crash services through heap memory exhaustion.. A patch is available.

How to fix or mitigate EUVD-2026-55989?

Within 24 hours, conduct an inventory of all WildFly deployments in your environment, identify instances with network-accessible IIOP endpoints (TCP 7496 by default), and assess exposure from untrusted networks. Within 7 days, implement firewall or security group rules restricting IIOP access to explicitly authorized internal systems only, deploy real-time monitoring for heap memory anomalies and OutOfMemoryError exceptions, and configure alerting on abnormal IIOP connection patterns. Within 30 days, monitor WildFly security advisories for patch release information, evaluate and plan upgrades for affected versions, and consider implementing redundant load-balanced WildFly deployments to improve service resilience and availability.

WildFly EUVD-2026-55989

| CVE-2026-15567 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-08-11 secalert@redhat.com

GHSA-h33j-vrhg-4q7j

Information Disclosure

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with no complexity barrier; impact is heap exhaustion DoS only with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:37 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

HIGH 7.5

DescriptionCVE.org

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

AnalysisAI

Uncontrolled heap allocation in WildFly's CSIv2Util GSS token decoder allows a remote unauthenticated attacker to trigger OutOfMemoryError by supplying a crafted length field, crashing or destabilizing the Java application server. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no authentication or user interaction is required, making this a trivially exploitable denial-of-service condition against any WildFly deployment with an accessible IIOP endpoint. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

WildFly (formerly JBoss AS) is Red Hat's Jakarta EE application server. The vulnerable component is CSIv2Util, which implements Common Secure Interoperability version 2 - an IIOP/CORBA security protocol used for enterprise Java interoperability. Within this component, the GSS (Generic Security Services) token decoder reads a caller-supplied length field from an inbound network message and passes that value directly as the size argument to a byte array allocation (e.g., new byte[attackerValue]) without validating it against any safe upper bound. This is a classic uncontrolled resource consumption pattern consistent with CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption), though no formal CWE was assigned in the advisory. A single crafted packet with an extremely large length value - up to Integer.MAX_VALUE (2,147,483,647) - can exhaust the JVM heap, forcing a java.lang.OutOfMemoryError. The CWE field in the advisory is listed as N/A, which appears to be an omission rather than a genuine classification gap.

Affected ProductsAI

WildFly application server instances configured with the CSIv2/IIOP subsystem are affected. Exact vulnerable version ranges are not specified in the available intelligence data; no CPE strings were provided. The Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15567 and the associated Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2491620 are the authoritative sources for version-specific scope and should be consulted to determine whether a given WildFly release is in the affected range.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15567 and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2491620 for patch availability and exact fixed version numbers, which were not available in the provided intelligence data and cannot be cited here without independent confirmation. As a primary compensating control, disable the IIOP/CSIv2 subsystem in WildFly's standalone.xml or domain.xml if CORBA-based interoperability is not required; this eliminates the attack surface entirely but breaks any CORBA-dependent integrations with external systems. If IIOP must remain enabled, restrict access to IIOP listener ports (commonly 3528 and 3529) at the network or host firewall level to only trusted upstream systems, preventing unauthenticated internet-facing exposure. JVM heap limits (-Xmx) will not prevent the vulnerability but can contain the blast radius by causing faster, restartable OOM failures rather than progressive resource exhaustion; ensure automated restart supervisors (systemd, Kubernetes liveness probes) are in place to recover availability quickly after a triggered crash.