CVE-2026-15567

CVE-2026-15567 in Wildfly's CSIv2Util GSS token decoder is a 7.5-severity vulnerability with a dangerous disconnect from its actual risk profile. The EPSS score of 0.00347 will likely cause organizations to deprioritize it—but this is a memory exhaustion vulnerability that warrants different treatment than the score suggests. The mechanism is straightforward: an unauthenticated remote attacker sends a single malformed packet with a weaponized length field. No authentication. No complex chain. The length value triggers direct memory allocation without validation, causing heap saturation. What happens next is the critical part that CVSS alone doesn't model. CSIv2 (Common Secure Interoperability) is the authentication broker for heterogeneous middleware components—when a Wildfly node exhausts its heap, it doesn't just go dark. Every downstream service that depends on it for authenticated calls begins timing out. Circuit breakers trip. Operations teams scramble across services that share no code with Wildfly except the CSIv2 handshake library. The blast radius of one malformed packet can cascade into a 30-minute incident involving multiple teams who each thought they had no exposure. The historical pattern compounds this. Uncontrolled allocation in parser code is a recurring vulnerability class—SunRPC XDR, DCE-RPC, RMI/IIOP deserialization paths all exhibit the same genetic flaw: attacker-controlled length field, direct allocation, OOM trigger. This isn't novel attack surface; it's a pattern that reliably gets weaponized once threat actors recognize it. There's also a temporal asymmetry that works against defenders. RCEs get patched fast because they're actively exploited. An OOM triggers a restart, the incident closes, and without a CVSS revision or elevated EPSS, there's no organizational pressure to remediate at the source. The vulnerability persists disclosed-but-unfixed far longer than comparably-scored data disclosure bugs—each day is an exposure window an attacker can trigger at will. Prioritize this differently than a typical 7.5. Check whether your Wildfly deployments expose CSIv2 (IIOP) remoting to untrusted networks—this is often enabled in clustered or distributed Java environments. If exposed externally, treat as critical. Even on internal networks, map the CSIv2 dependency chain: what services authenticate through this Wildfly node? Those are your second-order blast radius. Consider heap limit tuning as a temporary mitigation (hard limits won't prevent the DoS but will make the failure faster and more predictable), and monitor for GC thrashing patterns as a detection anchor.

Reviewed through automated stages and approved by a human before publication.