Bug 2480637 (CVE-2026-15555)

Summary: CVE-2026-15555 jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, asoldano, bbaranow, bmaxwell, bstansbe, dlofthou, istudens, ivassile, iweiss, mosmerov, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rstancel, security-response-team, smaestri, thjenkin, vdosoudi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-21 21:08:39 UTC 
indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5N_RGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.x2zmvwn62x0k

default JGroups protocol stacks ship without the AUTH protocol, allowing any network-adjacent host to join the cluster, and the Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

The root cause is CWE-502 (Deserialization of Untrusted Data) in the session replication marshalling path, combined with CWE-306 (Missing Authentication for Critical Function) on the JGroups cluster join interface. CVE-2016-2141 addressed AUTH bypass when AUTH was configured, but did not add AUTH to default stacks. CVE-2025-2251 addresses the same River unmarshaller deficiency in the EJB remote invocation path only — the fix commit (2656bb7) modified only ejb3/src/main/java/org/jboss/as/ejb3/subsystem/FilterSpecClassResolverFilter.java, leaving the Infinispan clustering marshaller completely unprotected.

Fix must add ClassResolverFilter to the SessionMarshallerFactory.JBOSS / JBossByteBufferMarshaller path in wildfly-clustering-web-extension
Comment 1 errata-xmlrpc 2026-08-11 16:37:32 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Via RHSA-2026:53644 https://access.redhat.com/errata/RHSA-2026:53644
Comment 2 errata-xmlrpc 2026-08-11 17:42:22 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4.25

Via RHSA-2026:53806 https://access.redhat.com/errata/RHSA-2026:53806