CVE-2026-15562: JBoss Remoting DoS Vulnerability

CVE-2026-15562 Overview

A flaw exists in Red Hat JBoss Enterprise Application Platform (EAP) jboss-remoting that enables remote unauthenticated denial of service. An attacker who can reach ports :8080, :9990, or :4447 and complete an Upgrade: jboss-remoting handshake can trigger out-of-memory (OOM) conditions in the server process. The resulting memory exhaustion degrades request handling server-wide, disrupting availability for legitimate users. The weakness is classified under CWE-190: Integer Overflow or Wraparound, which reflects the underlying miscalculation during handshake processing.

Critical Impact
Unauthenticated network attackers can crash or degrade JBoss EAP instances by completing a single protocol upgrade handshake, without credentials or user interaction.

Affected Products

Red Hat JBoss Enterprise Application Platform (EAP) — jboss-remoting component
Products covered by Red Hat Security Advisory RHSA-2026:53644
Products covered by Red Hat Security Advisory RHSA-2026:53806

Discovery Timeline

2026-08-11 - CVE-2026-15562 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-15562

Vulnerability Analysis

The vulnerability resides in jboss-remoting, the transport layer used by JBoss EAP for management and application traffic. The service accepts an HTTP Upgrade: jboss-remoting handshake on the standard HTTP listener (:8080), the management port (:9990), and the legacy remoting port (:4447). Once the upgrade completes, the server allocates buffers and state derived from attacker-supplied handshake fields. An integer overflow during size calculation causes disproportionate memory allocation. Repeated or crafted handshakes exhaust the Java heap, producing OutOfMemoryError exceptions. Because the affected allocator is shared across the server, thread pools and request pipelines stall, degrading all incoming requests, not only the attacker's connection.

Root Cause

The flaw is an integer overflow (CWE-190) in the handshake path of jboss-remoting. Untrusted length or count values are used in arithmetic that wraps, producing an under-sized bound but an over-sized allocation request. No authentication is required to reach the vulnerable code path.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker sends an HTTP request with an Upgrade: jboss-remoting header to any exposed port among :8080, :9990, or :4447, completes the upgrade, and supplies handshake parameters that trigger the overflow. Refer to the Red Hat CVE entry for CVE-2026-15562 and Red Hat Bugzilla Report #2483135 for protocol-level detail.

No verified proof-of-concept code is published for this issue.
See the referenced Red Hat advisories for technical background.

Detection Methods for CVE-2026-15562

Indicators of Compromise

Repeated HTTP requests containing the header Upgrade: jboss-remoting from a single or small set of source IP addresses.
java.lang.OutOfMemoryError entries in server.log correlated with active remoting connections.
Sudden growth of JBoss EAP heap usage and garbage collection pauses without a matching increase in legitimate workload.
Connection spikes on TCP ports 8080, 9990, or 4447 from external or untrusted networks.

Detection Strategies

Inspect reverse-proxy and web application firewall (WAF) logs for Upgrade: jboss-remoting requests, especially from clients that do not normally use the remoting protocol.
Alert on JVM metrics showing sustained heap saturation and elevated old-generation garbage collection time on EAP nodes.
Correlate application server thread pool exhaustion with new inbound remoting handshakes at the network layer.

Monitoring Recommendations

Export JBoss EAP JMX metrics for heap usage, thread pool queue depth, and remoting connection counts into your monitoring stack.
Enable access logging on the Undertow HTTP listener and forward it to a centralized log platform for query and alerting.
Track baseline traffic patterns on management port :9990 and remoting port :4447 and alert on any external exposure.

How to Mitigate CVE-2026-15562

Immediate Actions Required

Apply the updates published in RHSA-2026:53644 and RHSA-2026:53806 to all affected JBoss EAP instances.
Restrict inbound access to ports 8080, 9990, and 4447 so only trusted management networks and application clients can connect.
Audit reverse proxies and load balancers to confirm they do not forward Upgrade: jboss-remoting requests from untrusted networks.

Patch Information

Red Hat has issued fixes through the errata referenced above. Administrators should install the updated jboss-remoting package or EAP release for their supported channel, then restart the application server. Track advisory status through the Red Hat CVE page for CVE-2026-15562.

Workarounds

Place JBoss EAP behind a reverse proxy or WAF that blocks HTTP requests carrying the Upgrade: jboss-remoting header from untrusted sources.
Bind the management interface (:9990) and legacy remoting listener (:4447) to loopback or a private management VLAN until patching is complete.
Enforce per-source connection rate limits at the network edge to reduce the impact of repeated handshake attempts.

bash

# Example: block external access to JBoss EAP management and remoting ports with iptables
iptables -A INPUT -p tcp --dport 9990 ! -s 10.0.0.0/8 -j DROP
iptables -A INPUT -p tcp --dport 4447 ! -s 10.0.0.0/8 -j DROP

# Example: drop the jboss-remoting upgrade header at an NGINX reverse proxy
# in the relevant server or location block:
#   if ($http_upgrade ~* "jboss-remoting") { return 400; }