CVE-2020-10740 — Wildfly Unsafe Deserialization Vulnerability

Description

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

Affected products

Vendor	Product	Affected	Fixed
[UNKNOWN]	wildfly	Versions before 20.0.0.Final	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-glassfish-el +1	3.0.1-4.b08_redhat_00005.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-hibernate +5	5.1.17-3.Final_redhat_00004.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-databind	2.8.11.6-3.SP1_redhat_00003.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-ejb-client	4.0.12-1.Final_redhat_00002.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-netty +1	4.1.63-2.Final_redhat_00003.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-undertow	1.4.18-16.SP14_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly +1	7.1.11-4.GA_redhat_00002.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-elytron	1.1.14-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-http-client +4	1.0.21-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-naming-client	1.0.13-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-openssl +1	1.0.12-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-openssl-linux	1.0.12-6.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat JBoss EAP 7	eap7-dom4j	2.1.3-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.2.5-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-13.SP3_redhat_00011.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hal-console	3.0.23-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.17-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.19-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.22-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.4-1.redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.33-2.SP1_redhat_00001.1.el6eap	RHSA-2020:3142, RHSA-2020:3141
Red Hat JBoss EAP 7	eap7-jboss-genericjms	2.0.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-7.SP2_redhat_00005.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.15-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-modules	1.8.10-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-13.Final_redhat_00014.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-jboss-server-migration-eap7.3-server +6	1.7.1-7.Final_redhat_00009.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.7.6-4.SP3_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-netty +1	4.1.48-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-resteasy +19	3.6.1-10.SP9_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-undertow	2.0.30-4.SP4_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.0.6-4.Final_redhat_00004.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.8-6.GA_redhat_00003.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-common	1.5.2-1.Final_redhat_00002.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.6.8-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-elytron-tool	1.10.7-1.Final_redhat_00001.1.el6eap	RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.21-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.8-6.GA_redhat_00003.1.el7eap	RHSA-2020:3638, RHSA-2020:3462, RHSA-2020:3142
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.13-1.Final_redhat_00001.1.el6eap	RHSA-2020:3142, RHSA-2020:3141
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.11-1.Final_redhat_00001.1.el6eap	RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.wildfly:wildfly-parent	< 20.0.0.Final	20.0.0.Final	GHSA-vrmw-2xhq-hrmp

Advisories 10

RHSA-2025:9582 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:3141 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:3142 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
WID-SEC-2022-1912 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10740

CNA	v3.1	6.6
EUVD	v3.1	6.6
OSV:GHSA	v3.1	7.5