Bug 2491620 (CVE-2026-15567)

Summary: CVE-2026-15567 wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, gmalinko, istudens, ivassile, iweiss, janstey, mosmerov, mposolda, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rmartinc, rstancel, rstepani, security-response-team, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-23 03:08:14 UTC 
JBoss EAP's IIOP (Internet Inter-ORB Protocol) subsystem processes security tokens from CORBA clients as part of the CSIv2 (Common Secure Interoperability version 2) handshake. This processing happens before any authentication — triggered by a portable interceptor (SASTargetInterceptor) that fires on every single incoming IIOP request.
 
Two methods in CSIv2Util.java read a length field directly from the attacker-controlled network packet and immediately allocate a Java byte array of that size — with zero bounds checking:


  A single unauthenticated GIOP packet with a crafted length field can cause:
  - OutOfMemoryError — the JVM attempts a ~2 GB heap allocation and crashes
  - NegativeArraySizeException — integer overflow in the length field kills the worker thread
  - Both outcomes are repeatable — the attacker can sustain the DoS by sending packets in a loop