Description

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T09:17:13.100Z",
  "pubdate": "2026-08-11T09:17:13.100Z",
  "executiveSummary": "A denial of service vulnerability exists within the jboss-remoting component utilized by EAP. The flaw allows a remote, unauthenticated attacker to cause Out Of Memory (OOM) errors across the targeted server.\nThe vulnerability impacts systems running EAP with exposed ports such as 8080, 9990, or 4447. Successful exploitation leads to severe resource exhaustion, degrading request processing server-wide and culminating in a denial of service condition.\nExploitation requires network reachability to the vulnerable service ports and the ability to initiate and complete a specific protocol handshake. No prior authentication or elevated privileges are required by the threat actor to execute the attack.\nThe risk implications are significant for availability, as unauthenticated remote actors can disrupt core application services and administrative interfaces without interacting with application-layer authentication mechanisms.",
  "technicalDetails": "The root cause of the vulnerability lies in how the jboss-remoting component processes incoming connections and protocol handshakes on exposed listener ports, specifically ports 8080, 9990, and 4447.\nThe vulnerable component is the jboss-remoting subsystem within EAP. The flaw is triggered during the processing of connection upgrades.\nAn unauthenticated remote attacker initiates the attack vector by establishing a TCP connection to one of the reachable service ports. The attacker then issues an HTTP or protocol-specific request containing an Upgrade: jboss-remoting header.\nUpon receiving the request, the server attempts to process and complete the jboss-remoting handshake. Due to improper resource management or unconstrained memory allocation during this handshake phase, crafted or repetitive sequences consume excessive heap memory.\nThe step-by-step attack flow proceeds as follows: 1. The attacker connects to port 8080, 9990, or 4447 over the network. 2. The attacker sends a handshake initiation request utilizing the Upgrade: jboss-remoting mechanism. 3. The server allocates memory structures to handle the incoming remoting channel establishment. 4. Sustained or malformed handshake sequences exhaust available JVM heap memory, triggering Out Of Memory (OOM) errors.\nThe payload behavior centers on resource exhaustion rather than arbitrary code execution. The continuous memory allocation prevents garbage collection from reclaiming adequate space, leading to severe performance degradation across all deployed applications and administrative interfaces on the server.\nNetwork exposure is external, provided the target ports are reachable from the attacker's network position. Authentication and privilege requirements are entirely absent, as the vulnerability is triggered prior to any security context validation during the initial protocol upgrade handshake."
}