CVE-2026-24329 Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.
An authenticated administrative user can cause a denial of service by injecting a malformed payload into the management interface, crashing the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24329?
CVE-2026-24329 is a medium-severity denial of service vulnerability in Red Hat Fuse 7, published on 11 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.
Weakness: CWE-91
Which versions are affected by CVE-2026-24329?
How do I fix CVE-2026-24329?
No fix has been published for CVE-2026-24329 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-24329 being exploited?
There is no known exploitation of CVE-2026-24329 in the wild and no public exploit code.
Sources
Also known as GHSA-g28c-9r5g-f43w.