Wildfly: no timeout for eap management interface may lead to denial of service (dos)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 24.0.1.Final
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- wildfly
fixed in 24.0.1.Final
- org.wildfly.core/wildfly-domain-http-interface
Version range not reported
- eap7-hal-console
Version range not reported
- eap7-hibernate-validator
Version range not reported
- eap7-insights-java-client
Version range not reported
- eap7-ironjacamar
Version range not reported
- eap7-jboss-cert-helper
Version range not reported
- eap7-jboss-ejb-client
Version range not reported
- eap7-jboss-server-migration
Version range not reported
- eap7-jbossws-cxf
Version range not reported
- eap7-jsoup
Version range not reported
- eap7-undertow-jastow
Version range not reported
- eap7-wildfly
Version range not reported
- eap7-xalan-j2
Version range not reported
- eap7-hal-console
Version range not reported
- eap7-hibernate-validator
Version range not reported
- eap7-insights-java-client
Version range not reported
- eap7-ironjacamar
Version range not reported
- eap7-jboss-cert-helper
Version range not reported
- eap7-jboss-ejb-client
Version range not reported
- eap7-jboss-server-migration
Version range not reported
- eap7-jbossws-cxf
Version range not reported
- eap7-jsoup
Version range not reported
- eap7-undertow-jastow
Version range not reported
- eap7-wildfly
Version range not reported
- eap7-xalan-j2
Version range not reported
- eap7-hal-console
Version range not reported
- eap7-hibernate-validator
Version range not reported
- eap7-insights-java-client
Version range not reported
- eap7-ironjacamar
Version range not reported
- eap7-jboss-cert-helper
Version range not reported
- eap7-jboss-ejb-client
Version range not reported
- eap7-jboss-server-migration
Version range not reported
- eap7-jbossws-cxf
Version range not reported
- eap7-jsoup
Version range not reported
- eap7-undertow-jastow
Version range not reported
- eap7-wildfly
Version range not reported
- eap7-xalan-j2
Version range not reported
- wildfly-domain-http
Version range not reported
- eap8-activemq-artemis
Version range not reported
- eap8-activemq-artemis-native
Version range not reported
- eap8-aesh-extensions
Version range not reported
- eap8-aesh-readline
Version range not reported
- eap8-apache-commons-codec
Version range not reported
- eap8-apache-commons-collections
Version range not reported
- eap8-apache-commons-io
Version range not reported
- eap8-apache-commons-lang
Version range not reported
- eap8-apache-cxf
Version range not reported
- eap8-artemis-native
Version range not reported
- eap8-artemis-wildfly-integration
Version range not reported
- eap8-asyncutil
Version range not reported
- eap8-aws-java-sdk
Version range not reported
- eap8-cryptacular
Version range not reported
- eap8-eap-product-conf-parent
Version range not reported
- eap8-fastinfoset
Version range not reported
- eap8-hibernate
Version range not reported
- eap8-hibernate-validator
Version range not reported
- eap8-hppc
Version range not reported
- eap8-insights-java-client
Version range not reported
- eap8-jakarta-servlet-jsp-jstl-api
Version range not reported
- eap8-jboss-cert-helper
Version range not reported
- eap8-jboss-logging
Version range not reported
- eap8-jctools
Version range not reported
- eap8-jgroups
Version range not reported
- eap8-log4j
Version range not reported
- eap8-narayana
Version range not reported
- eap8-nimbus-jose-jwt
Version range not reported
- eap8-objectweb-asm
Version range not reported
- eap8-pem-keystore
Version range not reported
- eap8-resteasy-extensions
Version range not reported
- eap8-resteasy-spring
Version range not reported
- eap8-saaj-impl
Version range not reported
- eap8-shibboleth-java-support
Version range not reported
- eap8-slf4j
Version range not reported
- eap8-snakeyaml
Version range not reported
- eap8-wildfly
Version range not reported
- eap8-activemq-artemis
Version range not reported
- eap8-activemq-artemis-native
Version range not reported
- eap8-aesh-extensions
Version range not reported
- eap8-aesh-readline
Version range not reported
- eap8-apache-commons-codec
Version range not reported
- eap8-apache-commons-collections
Version range not reported
- eap8-apache-commons-io
Version range not reported
- eap8-apache-commons-lang
Version range not reported
- eap8-apache-cxf
Version range not reported
- eap8-artemis-native
Version range not reported
- eap8-artemis-wildfly-integration
Version range not reported
- eap8-asyncutil
Version range not reported
- eap8-aws-java-sdk
Version range not reported
- eap8-cryptacular
Version range not reported
- eap8-eap-product-conf-parent
Version range not reported
- eap8-fastinfoset
Version range not reported
- eap8-hibernate
Version range not reported
- eap8-hibernate-validator
Version range not reported
- eap8-hppc
Version range not reported
- eap8-insights-java-client
Version range not reported
- eap8-jakarta-servlet-jsp-jstl-api
Version range not reported
- eap8-jboss-cert-helper
Version range not reported
- eap8-jboss-logging
Version range not reported
- eap8-jctools
Version range not reported
- eap8-jgroups
Version range not reported
- eap8-log4j
Version range not reported
- eap8-narayana
Version range not reported
- eap8-nimbus-jose-jwt
Version range not reported
- eap8-objectweb-asm
Version range not reported
- eap8-pem-keystore
Version range not reported
- eap8-resteasy-extensions
Version range not reported
- eap8-resteasy-spring
Version range not reported
- eap8-saaj-impl
Version range not reported
- eap8-shibboleth-java-support
Version range not reported
- eap8-slf4j
Version range not reported
- eap8-snakeyaml
Version range not reported
- eap8-wildfly
Version range not reported
- wildfly-domain-http
Version range not reported
- wildfly-domain-http
Version range not reported
- wildfly-domain-http
Version range not reported
- wildfly-domain-http
Version range not reported
- wildfly-domain-http
Version range not reported
- wildfly-domain-http
Version range not reported
- wildfly-domain-http
Version range not reported
- org.wildfly:wildfly-domain-httpMaven
through 24.0.0.Final