Name: CVE-2026-15567: Memory Allocation with Excessive Size Value
Creator: Rapid7
Published: 2026-08-11T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-15567, CWE-789, CVSS 7.5, EPSS 0.00888

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Red Hat Jboss Eap	—	Upgrade Red Hat JBoss EAP to the latest version	Aug 14, 2026	Aug 11, 2026
Redhat_linux	—	Upgrade eap8-activemq-artemis-hornetq-protocolUpgrade eap8-jaxbUpgrade eap8-eap-product-conf-parentUpgrade eap8-slf4jUpgrade eap8-jbossws-cxfUpgrade eap8-netty-resolverUpgrade eap8-artemis-wildfly-integrationUpgrade eap8-jaxb-xjcUpgrade eap8-apache-cxfUpgrade eap8-netty-bufferUpgrade eap8-jackson-coreUpgrade eap8-netty-handler-proxyUpgrade eap8-eap-product-conf-wildfly-ee-feature-packUpgrade eap8-activemq-artemis-jakarta-service-extensionsUpgrade eap8-ironjacamar-jdbcUpgrade eap8-bouncycastleUpgrade eap8-activemq-artemis-commonsUpgrade eap8-rngomUpgrade eap8-netty-transport-native-epollUpgrade eap8-ironjacamar-common-implUpgrade eap8-nettyUpgrade eap8-jaxbintrosUpgrade eap8-apache-cxf-rtUpgrade eap8-httpcomponents-asyncclientUpgrade eap8-ironjacamarUpgrade eap8-wildfly-java-jdk21Upgrade eap8-hibernateUpgrade eap8-ironjacamar-deployers-commonUpgrade eap8-apache-cxf-toolsUpgrade eap8-xsomUpgrade eap8-activemq-artemis-selectorUpgrade eap8-jakarta-xml-bind-apiUpgrade eap8-jackson-modules-java8Upgrade eap8-netty-resolver-dnsUpgrade eap8-jackson-dataformat-yamlUpgrade eap8-codemodelUpgrade eap8-netty-codec-httpUpgrade eap8-activemq-artemis-journalUpgrade eap8-ws-commons-XmlSchemaUpgrade eap8-netty-codecUpgrade eap8-jbossws-spiUpgrade eap8-ironjacamar-validatorUpgrade eap8-bouncycastle-provUpgrade eap8-jboss-remotingUpgrade eap8-activemq-artemis-serverUpgrade eap8-jackson-datatype-jsr310Upgrade eap8-jackson-jaxrs-json-providerUpgrade eap8-activemq-artemisUpgrade eap8-xml-securityUpgrade eap8-jboss-loggingUpgrade eap8-jackson-databindUpgrade eap8-activemq-artemis-jakarta-clientUpgrade eap8-txw2Upgrade eap8-bouncycastle-pkixUpgrade eap8-netty-handlerUpgrade eap8-jsf-implUpgrade eap8-hibernate-coreUpgrade eap8-netty-codec-dnsUpgrade eap8-bouncycastle-pgUpgrade eap8-jaxb-runtimeUpgrade eap8-activemq-artemis-jakarta-raUpgrade eap8-wildfly-modulesUpgrade eap8-activemq-artemis-jakarta-serverUpgrade eap8-netty-commonUpgrade eap8-bouncycastle-utilUpgrade eap8-jbossws-jaxws-undertow-httpspiUpgrade eap8-wildflyUpgrade eap8-log4jUpgrade eap8-relaxng-datatypeUpgrade eap8-activemq-artemis-core-clientUpgrade eap8-jaxb-core	Sep 24, 2026	Aug 11, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence