CVE-2026-15561
🟡 Monitoruj
Błąd w dekoderze chunked-transfer EAP umożliwia atakującemu wywołanie Denial of Service.
CVSS
7.5
EPSS
0.4%
Exploit
none
Vendor
Opis źródłowy (NVD)
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
dos
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.4% |
| Opublikowano (NVD) | 2026-08-11 09:17:12 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-18 00:16:55 UTC |
Referencje
- https://access.redhat.com/errata/RHSA-2026:53644 ([email protected])
- https://access.redhat.com/errata/RHSA-2026:53645 ([email protected])
- https://access.redhat.com/errata/RHSA-2026:53646 ([email protected])
- https://access.redhat.com/errata/RHSA-2026:53806 ([email protected])
- https://access.redhat.com/security/cve/CVE-2026-15561 ([email protected])
- https://bugzilla.redhat.com/show_bug.cgi?id=2483133 ([email protected])