CVE-2026-15567
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
Risk Assessment
The risk includes server memory exhaustion, which could lead to service unavailability and application crashes.
Recommendation
Update Wildfly to a patched version and implement memory monitoring and restrictions for unauthenticated requests.
Original NVD description (English source)
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.