JBoss EAP's IIOP (Internet Inter-ORB Protocol) subsystem processes security tokens from CORBA clients as part of the CSIv2 (Common Secure Interoperability version 2) handshake. This processing happens before any authentication — triggered by a portable interceptor (SASTargetInterceptor) that fires on every single incoming IIOP request.
 
Two methods in CSIv2Util.java read a length field directly from the attacker-controlled network packet and immediately allocate a Java byte array of that size — with zero bounds checking:


  A single unauthenticated GIOP packet with a crafted length field can cause:
  - OutOfMemoryError — the JVM attempts a ~2 GB heap allocation and crashes
  - NegativeArraySizeException — integer overflow in the length field kills the worker thread
  - Both outcomes are repeatable — the attacker can sustain the DoS by sending packets in a loop