Description
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | jbossws-common | 1.1.0-4.SP7_patch_02.1.ep5.el5 | RHSA-2011:1303 |
| Red Hat JBoss EAP 5 | jbossws-common | 1.1.0-4.SP7_patch_02.1.ep5.el4 | RHSA-2011:1301 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-6.GA_CP09.11.ep1.el4 | RHSA-2011:1309 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-5.GA_CP07_patch_01.1.ep1.el4 | RHSA-2011:1306 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.ws:jbossws-common | < 2.1.0.Final | 2.1.0.Final | GHSA-rj4p-7mm6-gm9j |
Advisories 4
- RHSA-2011:1309 Red Hat Security Advisory: jbossas security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2011:1303 Red Hat Security Advisory: jbossws-common security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2011:1306 Red Hat Security Advisory: jbossws-common security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2011:1301 Red Hat Security Advisory: jbossws-common security update Red Hat Security Advisories (RHSA) · Aug 5, 2026