CVE-2026-24329

Published: Aug 11, 2026Modified: Aug 14, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.2 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (2)

https://access.redhat.com/security/cve/CVE-2026-24329

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2431938

Source: secalert@redhat.com

Timeline

No history available yet.