Advisoriesby IbisRed HatCVE-2026-15561
Red Hat JBoss Enterprise Application Platform 7.4.25: denial of service
No fix yet
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7.4.25 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-770
- www.cve.org/CVERecord?id=CVE-2026-15561
- nvd.nist.gov/vuln/detail/CVE-2026-15561
- access.redhat.com/errata/RHSA-2026:53644
- access.redhat.com/errata/RHSA-2026:53806
- access.redhat.com/errata/RHSA-2026:70228
- access.redhat.com/errata/RHSA-2026:70229
- access.redhat.com/errata/RHSA-2026:70230
- access.redhat.com/errata/RHSA-2026:70277
- access.redhat.com/security/cve/CVE-2026-15561
- bugzilla.redhat.com/show_bug.cgi?id=2483133