Vulnerability · Published Aug 11, 2026 · Assigned by redhat
CVE-2026-15562Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service
High 7.5
In plain English
A high-severity integer overflow in Red Hat JBoss Enterprise Application Platform 7.4.25 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 40.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:53644 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:53806 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70228 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70229 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70230 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:70277 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-15562 vdb-entry, x_refsource_REDHAT
- RHBZ#2483135 issue-tracking, x_refsource_REDHAT