Executive brief
WildFly is an open-source Java application server used to run enterprise applications. A remote attacker without credentials can send a specially crafted network request to trigger an out-of-memory condition, causing the server to crash and making applications unavailable. This can disrupt business operations and customer access to online services.
Technical details
The vulnerability is an unbounded memory allocation flaw in WildFly's CSIv2Util component, which handles GSS (Generic Security Service) token decoding for CORBA/CSI authentication. The vulnerable code reads an attacker-controlled length field from the incoming token without validating its bounds, then attempts to allocate a byte array of that size. An unauthenticated remote attacker can send a token with an extremely large length value to trigger an OutOfMemoryError, exhausting heap memory and crashing the server. The attack is network-reachable and requires no authentication or user interaction. A patch is expected from Red Hat.
Affected products
- Red Hat WildFly <UNKNOWN>
Timeline
- 2026-08-11: disclosed