CVE-2026-24329
Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.
- State
- Published
- Severity
- 4.9 Medium
- Published
- Aug 11, 2026
- Updated
- Aug 12, 2026
- Reserved
- Jan 22, 2026
Description
A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H | redhat |
Weaknesses
- CWE-91 XML Injection (aka Blind XPath Injection)
Affected Products
| Product | Versions |
|---|---|
Red Hat Fuse 7Red Hat | |
Red Hat JBoss Enterprise Application Platform 7Red Hat | |
Red Hat JBoss Enterprise Application Platform 8Red Hat | |
Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat | |
Red Hat Process Automation 7Red Hat | |
Red Hat Single Sign-On 7Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-24329vdb-entry
- RHBZ#2431938issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.