CVE-2026-15567: WildFly DOS Vulnerability

CVE-2026-15567 Overview

CVE-2026-15567 is a denial of service vulnerability in Red Hat WildFly. A remote unauthenticated attacker can trigger an OutOfMemoryError by sending a crafted GSS token to the CSIv2Util component. The CSIv2Util GSS token decoder reads an attacker-controlled length field without bounds checking. It then attempts to allocate a byte array of that size, exhausting available heap memory.

The flaw is tracked under CWE-789: Memory Allocation with Excessive Size Value. The vulnerability affects availability only; confidentiality and integrity are not impacted.

Critical Impact
Remote unauthenticated attackers can crash WildFly application servers by triggering uncontrolled memory allocation through the CSIv2 GSS token decoder.

Affected Products

Red Hat WildFly (see Red Hat CVE-2026-15567 for affected version ranges)
Red Hat JBoss Enterprise Application Platform components incorporating the CSIv2Util decoder
Products referenced in Red Hat Security Errata RHSA-2026:53806

Discovery Timeline

2026-08-11 - CVE-2026-15567 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15567

Vulnerability Analysis

The vulnerability resides in the CSIv2Util class, which handles Common Secure Interoperability Version 2 (CSIv2) protocol messages used by CORBA-based IIOP services in WildFly. When decoding a Generic Security Services (GSS) token, the decoder reads a length prefix directly from the incoming message. It uses that value to allocate a backing byte array before validating whether the declared length matches the actual data available.

An attacker supplies a very large length field. The Java Virtual Machine (JVM) attempts to allocate an oversized array and raises an OutOfMemoryError. Repeated requests can destabilize the server process and interrupt service for legitimate clients.

Root Cause

The root cause is missing bounds validation on an untrusted length field prior to allocation, classified as CWE-789: Memory Allocation with Excessive Size Value. The decoder trusts a length value supplied over the network without cross-checking against the remaining buffer size or a maximum allowable token length.

Attack Vector

Exploitation requires network access to a WildFly instance exposing IIOP with CSIv2 security context handling. No authentication or user interaction is required. An attacker sends a crafted CSIv2 message containing a GSS token with a maliciously large length prefix. The decoder attempts the allocation, and the JVM throws OutOfMemoryError, degrading or halting the server.

No verified public proof-of-concept code is available. Refer to Red Hat Bugzilla Report #2491620 for vendor technical details.

Detection Methods for CVE-2026-15567

Indicators of Compromise

Recurring java.lang.OutOfMemoryError entries in server.log or standard output originating from CSIv2Util or GSS token decoding stack frames.
Unexpected JVM heap dumps or process restarts on WildFly instances exposing IIOP listeners.
Inbound IIOP or CSIv2 traffic from untrusted networks preceding server instability.

Detection Strategies

Monitor WildFly application server logs for stack traces referencing CSIv2Util allocation failures.
Inspect network flow data for unsolicited connections to IIOP ports (default 3528 and 3529) from external sources.
Correlate JVM memory pressure spikes with inbound CSIv2 message volume.

Monitoring Recommendations

Enable JVM garbage collection and memory allocation logging on WildFly nodes handling CORBA/IIOP workloads.
Ingest WildFly and JVM logs into a centralized platform to alert on repeated OutOfMemoryError events.
Baseline IIOP request rates and alert on statistically significant deviations that may indicate abuse.

How to Mitigate CVE-2026-15567

Immediate Actions Required

Apply the updates provided in Red Hat Security Errata RHSA-2026:53806 to affected WildFly and JBoss EAP installations.
Restrict network access to WildFly IIOP and CSIv2 endpoints so that only trusted clients can reach them.
Review WildFly configurations and disable the IIOP subsystem where CSIv2 is not required by application workloads.

Patch Information

Red Hat has published the fix in RHSA-2026:53806. Consult the Red Hat CVE-2026-15567 advisory for the definitive list of fixed package versions and affected product streams.

Workarounds

Disable the IIOP subsystem in standalone.xml or domain.xml if CORBA interoperability is not needed.
Place WildFly behind a network policy or firewall that blocks external access to IIOP listener ports.
Set conservative JVM heap limits and configure process supervision to restart the server after an OutOfMemoryError, reducing outage duration while patching is scheduled.

bash

# Example: remove the IIOP subsystem via the WildFly CLI
/subsystem=iiop-openjdk:remove
reload