CVE-2026-15567: Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
Other sources
JBoss EAP's IIOP (Internet Inter-ORB Protocol) subsystem processes security tokens from CORBA clients as part of the CSIv2 (Common Secure Interoperability version 2) handshake. This processing happens before any authentication — triggered by a portable interceptor (SASTargetInterceptor) that fires on every single incoming IIOP request. Two methods in CSIv2Util.java read a length field directly from the attacker-controlled network packet and immediately allocate a Java byte array of that size — with zero bounds checking:
A single unauthenticated GIOP packet with a crafted length field can cause: - OutOfMemoryError — the JVM attempts a ~2 GB heap allocation and crashes - NegativeArraySizeException — integer overflow in the length field kills the worker thread - Both outcomes are repeatable — the attacker can sustain the DoS by sending packets in a loop
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15567?
The severity of CVE-2026-15567 is rated high with a score of 7.5.
How do I fix CVE-2026-15567?
To fix CVE-2026-15567, it is recommended to update Wildfly to the latest version that addresses this vulnerability.
What type of attack does CVE-2026-15567 enable?
CVE-2026-15567 enables a remote unauthenticated denial of service attack on the IIOP listener.
What component of Wildfly is affected by CVE-2026-15567?
CVE-2026-15567 affects the wildfly-iiop component of Wildfly.
Does CVE-2026-15567 affect confidentiality or integrity?
CVE-2026-15567 does not affect confidentiality or integrity but can lead to an availability issue.