Executive Summary
A denial of service vulnerability was found in Red Hat JBoss Enterprise Application Platform's jboss-remoting component. The vulnerability, tracked as CVE-2026-15562, has a CVSS score of 7.5 and can be exploited by a remote unauthenticated attacker. The attacker can cause Out-of-Memory (OOM) errors that degrade requests server-wide, leading to a denial of service.Technical Analysis
The vulnerability is caused by a flaw in the jboss-remoting component, which allows a remote unauthenticated attacker to complete an Upgrade: jboss-remoting handshake and cause OOM errors. The attack vector involves reaching specific ports (8080, 9990, or 4447) and completing the handshake. The root cause of the vulnerability is related to the handling of incoming requests and the allocation of resources.How It Gets Exploited
An attacker can exploit this vulnerability by sending a crafted request to the vulnerable component. The attacker would need to be able to reach the specific ports (8080, 9990, or 4447) and complete the Upgrade: jboss-remoting handshake. Once the handshake is completed, the attacker can cause OOM errors that degrade requests server-wide, leading to a denial of service. The attacker does not need to authenticate or have any prior knowledge of the system.Impact Assessment
The vulnerability affects multiple versions of Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7. The affected products include eap7-activemq-artemis, eap7-glassfish-jsf, eap7-ironjacamar, eap7-jackson-annotations, eap7-jackson-core, eap7-jackson-databind, eap7-jackson-jaxrs-providers, and eap7-jackson-modules-base. The vulnerability can be exploited to cause a denial of service, which can have a significant impact on the availability of the system.Recommended Actions
To mitigate this vulnerability, administrators should update to the latest version of Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7. Specifically, they should update the affected packages to the following versions: eap7-activemq-artemis to 0:2.16.0-22.redhat_00057.1.el7eap or later, eap7-glassfish-jsf to 0:2.3.14-11.SP11_redhat_00001.1.el7eap or later, eap7-ironjacamar to 0:1.5.26-2.Final_redhat_00001.1.el7eap or later, eap7-jackson-annotations to 0:2.18.8-1.redhat_00003.1.el7eap or later, eap7-jackson-core to 0:2.18.8-1.redhat_00003.1.el7eap or later, eap7-jackson-databind to 0:2.18.8-1.redhat_00003.1.el7eap or later, eap7-jackson-jaxrs-providers to 0:2.18.8-1.redhat_00003.1.el7eap or later, and eap7-jackson-modules-base to 0:2.18.8-1.redhat_00003.1.el7eap or later. Additionally, administrators should monitor their systems for any suspicious activity and implement network segmentation and access controls to limit the attack surface.