Project Subscriptions
No advisories yet.
Solution
No solution given by the vendor.
Workaround
Deploy a re-framing layer-7 reverse proxy such as nginx, HAProxy in http mode, or an AWS Application Load Balancer in front of the affected JBoss EAP listener. Because such a proxy terminates and re-frames the HTTP/1.1 chunked request, an oversized chunked trailer cannot be passed through to Undertow, which fully mitigates this issue. Direct-edge and layer-4/TCP load-balanced deployments lack this protection; for those deployments, no other workaround meeting Red Hat Product Security criteria is available, and the fixes being delivered for the affected EAP streams should be applied when released.
Sun, 01 Nov 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Sun, 01 Nov 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9 |
Fri, 23 Oct 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 |
Tue, 20 Oct 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs |
Fri, 25 Sep 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4 |
|
| References |
|
Tue, 22 Sep 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
|
| References |
|
Thu, 17 Sep 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9 | |
| References |
|
Thu, 17 Sep 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 |
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8 |
| References |
|
Mon, 24 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 |
Wed, 12 Aug 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 | |
| References |
|
Tue, 11 Aug 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat jboss Enterprise Application Platform Els
|
|
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 | |
| Vendors & Products |
Redhat jboss Enterprise Application Platform Els
|
|
| References |
|
Tue, 11 Aug 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 11 Aug 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat jboss Enterprise Application Platform Expansion Pack
|
|
| Vendors & Products |
Redhat jboss Enterprise Application Platform Expansion Pack
|
Tue, 11 Aug 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Tue, 11 Aug 2026 09:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service. | |
| Title | Undertow-core: oom via missing limits in chunked trailer in eap's undertow | |
| First Time appeared |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp |
|
| Weaknesses | CWE-770 | |
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jbosseapxp |
|
| Vendors & Products |
Redhat
Redhat jboss Enterprise Application Platform Redhat jbosseapxp |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-11-01T00:11:43.736Z
Reserved: 2026-07-13T05:08:26.350Z
Link: CVE-2026-15561
Updated: 2026-08-11T16:09:47.787Z
Status : Awaiting Analysis
Published: 2026-08-11T09:17:12.963
Modified: 2026-11-01T01:17:25.440
Link: CVE-2026-15561
OpenCVE Enrichment
Updated: 2026-08-11T13:45:04Z