Description
A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame. The highest threat from this vulnerability is to system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | JBossWeb | JBossWeb versions before 7.5.31.Final-redhat-3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.24-2.Final_redhat_00001.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.24-1.Final_redhat_00001.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.45-2.Final_redhat_2.1.ep6.el6 | RHSA-2022:5460, RHSA-2022:5459 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.31-3.Final_redhat_3.1.ep6.el5 | RHSA-2022:5460, RHSA-2022:5459, RHSA-2020:3730 |
Advisories 3
- RHSA-2022:5460 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:5459 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.24 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3730 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025