Wildfly
4 posts tagged with “Wildfly”
CVE-2026-15554: Undertow AJP Authentication Bypass via Forged Client Certificate Attributes
Undertow AJP CLIENT-CERT authentication bypass via forged ssl_cert and is_ssl attributes. An unauthenticated attacker who reaches port 8009 can bypass mutual TLS authentication. Part of the Ghostcat-class AJP trust model flaws.
CVE-2026-15555: JBoss EAP Deserialization RCE via Unfiltered River Unmarshaller in Session Replication
JBoss EAP and WildFly cluster deserialization RCE. The Infinispan session replication path deserializes through JBoss Marshalling River unmarshaller with no class filtering. Network access to the clustering port yields code execution on every cluster node.
CVE-2026-24329: WildFly Denial of Service via Malformed Payload Injection
WildFly-core Management Model writes unsanitized user input into standalone.xml, allowing an admin to corrupt the config file and cause an unrecoverable server crash.
CVE-2026-24330: WildFly Arbitrary File Read via Malicious Archive Deployment
WildFly-core deployment handler accepts malicious archives from authenticated deployer-role users, enabling arbitrary file read of server filesystem including credentials and configuration secrets.