{"id":"CVE-2026-15561","title":"A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder","summary":"A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"Red Hat","product":"eap7-activemq-artemis","affected":["eap7-activemq-artemis (all versions)","eap7-glassfish-jsf (all versions)","eap7-ironjacamar (all versions)","eap7-jackson-annotations (all versions)","eap7-jackson-core (all versions)","eap7-jackson-databind (all versions)","eap7-jackson-jaxrs-providers (all versions)","eap7-jackson-modules-base (all versions)","eap7-jackson-modules-java8 (all versions)","eap7-jboss-remoting (all versions)","eap7-jboss-server-migration (all versions)","eap7-netty (all versions)","eap7-netty-transport-native-epoll (all versions)","eap7-picketlink-bindings (all versions)","eap7-picketlink-federation (all versions)","eap7-undertow (all versions)","eap7-wildfly (all versions)","eap7-activemq-artemis (all versions)","eap7-glassfish-jsf (all versions)","eap7-ironjacamar (all versions)","eap7-jackson-annotations (all versions)","eap7-jackson-core (all versions)","eap7-jackson-databind (all versions)","eap7-jackson-jaxrs-providers (all versions)","eap7-jackson-modules-base (all versions)","eap7-jackson-modules-java8 (all versions)","eap7-jboss-remoting (all versions)","eap7-jboss-server-migration (all versions)","eap7-netty (all versions)","eap7-netty-transport-native-epoll (all versions)","eap7-picketlink-bindings (all versions)","eap7-picketlink-federation (all versions)","eap7-undertow (all versions)","eap7-wildfly (all versions)","eap7-activemq-artemis (all versions)","eap7-glassfish-jsf (all versions)","eap7-ironjacamar (all versions)","eap7-jackson-annotations (all versions)","eap7-jackson-core (all versions)","eap7-jackson-databind (all versions)","eap7-jackson-jaxrs-providers (all versions)","eap7-jackson-modules-base (all versions)","eap7-jackson-modules-java8 (all versions)","eap7-jboss-remoting (all versions)","eap7-jboss-server-migration (all versions)","eap7-netty (all versions)","eap7-netty-transport-native-epoll (all versions)","eap7-picketlink-bindings (all versions)","eap7-picketlink-federation (all versions)","eap7-undertow (all versions)"],"published":"2026-08-11","updated":"2026-09-18","sourceUpdated":"2026-09-18T00:16:55.507","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-15561","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:53644","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:53806","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-15561","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483133","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15561.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15561"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15561"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-11T16:09:41.801549Z"},"epss":0.00371,"epssPercentile":0.30893,"ingestedAt":"2026-09-17T19:26:25.289Z","patched":["jboss_eap_7_4_els_for_rhel_7_server","jboss_eap_7_4_els_for_rhel 8","jboss_eap_7_4_els_for_rhel 9"],"slug":"CVE-2026-15561","body":"## Overview\n\nA flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:53644** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53644)\n- **RHSA-2026:53645** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53645)\n- **RHSA-2026:53646** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53646)\n- **Red Hat VEX** · Important · affected: Red Hat JBoss Enterprise Application Platform 8 · no fix planned: Red Hat JBoss Enterprise Application Platform 8 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15561.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}