VDB

CVE-2026-15561

CVE-2026-15561 PUBLISHED CVSS 7.5 HIGH

Reported by redhat · Published August 11, 2026

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red HatRed Hat JBoss Enterprise Application Platform 7.4.25
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.16.0-22.redhat_00057.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.3.14-11.SP11_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:1.5.26-2.Final_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:5.0.31-3.SP2_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:1.10.0-46.Final_redhat_00044.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:4.1.135-1.Final_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:4.1.135-1.Final_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.5.5-30.SP12_redhat_00020.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.5.5-24.SP12_redhat_00016.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.2.40-2.SP3_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:7.4.25-2.GA_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 80:2.16.0-22.redhat_00057.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 80:2.3.14-11.SP11_redhat_00001.1.el8eap

…and 340 more

Timeline

  • Aug 11, 2026 EPSS Score
  • Aug 11, 2026 Coalition ESS Score
  • Aug 11, 2026 CVE Published
  • Aug 12, 2026 Distribution Patch
  • Aug 12, 2026 Security Advisory
  • Aug 12, 2026 Distribution Patch
  • Aug 12, 2026 Security Advisory
  • Aug 16, 2026 Security Advisory
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 4, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›