Description

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T09:17:13.530Z",
  "pubdate": "2026-08-11T09:17:13.530Z",
  "executiveSummary": "A denial of service vulnerability exists within Wildfly, specifically residing in the CSIv2Util component's GSS token decoder. The flaw stems from a lack of bounds checking when processing an attacker-controlled length field during GSS token decoding.\nA remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted payload containing a maliciously large length value to the vulnerable service. When the application attempts to process this value, it tries to allocate a byte array matching the attacker-specified size, directly resulting in an OutOfMemoryError.\nThe primary impact of this vulnerability is a complete denial of service for the affected Wildfly instance, as the JVM crashes or becomes entirely unresponsive due to memory exhaustion. The risk implications are severe for availability, requiring service restarts and potential operational disruption.\nExploitation requires network access to the Wildfly endpoint utilizing the affected CSIv2 protocol functionality. No prior authentication, user interaction, or elevated privileges are required by the attacker to successfully trigger the out-of-memory condition.",
  "technicalDetails": "The vulnerability is localized within the CSIv2Util GSS token decoder component of Wildfly. The root cause of the flaw is insufficient input validation and a complete absence of bounds checking on an attacker-controlled length field embedded within incoming network data streams.\nDuring the parsing of GSS tokens by CSIv2Util, the decoding logic extracts a length descriptor directly from the untrusted payload without verifying whether the declared size exceeds available buffer limits, reasonable protocol maximums, or available heap memory constraints.\nThe step-by-step attack flow proceeds as follows: First, a remote unauthenticated attacker establishes a network connection to the Wildfly service exposing the CSIv2 protocol interface. Second, the attacker transmits a meticulously crafted network payload where the GSS token length field is populated with an excessively large integer value. Third, the vulnerable CSIv2Util decoder reads this uncontrolled length field. Fourth, without validating the bounds of the input, the application attempts to dynamically allocate a byte array in memory matching the massive size specified by the attacker.\nBecause the requested allocation size vastly exceeds normal operational parameters, it immediately exhausts available Java Virtual Machine (JVM) heap memory. This triggers an unhandled OutOfMemoryError, causing the affected thread or the entire JVM process to terminate abruptly, thereby instigating a denial of service.\nThe affected component is the CSIv2Util GSS token decoder within Wildfly. Prerequisites for exploitation include network exposure of the vulnerable protocol endpoint and the absence of pre-authentication barriers for the specific parsing routine. The attack vector is strictly network-based, requiring no privileges or authentication tokens from the malicious actor."
}