A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

A remote user authenticated as ‘deployer’ account can import and deploy a malicious archive file from an untrusted source outside the intended control environment. In this specific case, the attacker leveraged WildFly (open source) libraries to craft a Java project that enabled them to perform an HTTP POST request to upload and deploy the malicious archive file from the untrusted source. In this particular scenario, the archive file is a WAR that contains a “read.jsp” page. Once the attacker uploads this file, they can leverage it to exploit other vulnerabilities, such as Arbitrary File Read, as dimostrated in this case.

Wildfly does not neutralize or incorrectly neutralizes user- controllable input before it is placed in output that is used as a web page that is served to other users.

A vulnerability was found in Wildfly. A user may perform cross-site scripting in Wildfly deployment system. An attacker (or insider) may execute a deploy with a malicious payload which could trigger an undesired behavior against the server.

A vulnerability was found in Wildfly, where there is a possibility of potential memory leak when using OpenTracing API's java-interceptors which may eventually lead to unavailability of the services.

It was found that the OpenSSL security provider does not honor TLS version in 'enabled-protocols' value of Wildfly's legacy security configuration. An attacker could target traffic sent over a TLS connection with a weaker version of TLS and potentially break the encryption of the data stream.