Description
A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer. An attacker could use this flaw to cause denial of service via high CPU caused by an infinite loop.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | jboss-remoting | since 3.3.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-25.SP23_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.23-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.41-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | jboss-as-ee +62 | 7.5.19-2.Final_redhat_2.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.19-2.Final_redhat_2.ep6.el6 | RHSA-2018:0275 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.40-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.12-2.Final_redhat_2.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.27-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.3.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | picketlink-bindings | 2.5.4-22.SP18_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.5.4-20.SP18_redhat_1.1.ep6.el5 | RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- JBoss Remoting 6.14.18 - Denial of Service EDB-44099 · dos · Feb 16, 2018
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2018:0271 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.19 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0275 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0268 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.19 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0270 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.19 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 44099 exploit
- RHSA-2018:0269 vendor-advisory
- RHSA-2018:0270 vendor-advisory
- RHSA-2018:0271 vendor-advisory
- RHSA-2018:0268 vendor-advisory
- RHSA-2018:0275 vendor-advisory
- 1040323 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1530457