Description
A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Apache Camel 4.4.0 for Spring Boot | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Integration Camel K 1 | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jboss-xnio | No fix yet | — |
| Debian 13 | jboss-xnio | No fix yet | — |
| Debian 12 | jboss-xnio | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jboss-xnio | No fix yet | — |
| Ubuntu 26.04 LTS | jboss-xnio | No fix yet | — |
| Ubuntu 25.10 | jboss-xnio | No fix yet | — |
| Ubuntu 24.04 LTS | jboss-xnio | No fix yet | — |
| Ubuntu 22.04 LTS | jboss-xnio | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jboss-xnio | No fix yet | — |
| Ubuntu 18.04 LTS | jboss-xnio | No fix yet | — |
| Ubuntu 16.04 LTS | jboss-xnio | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-3.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-avro | 1.7.6-2.redhat_00003.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00005.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-h2database | 1.4.197-2.redhat_00005.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-annotations-api_1.3_spec | 2.0.1-4.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-marshalling +1 | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-12.Final_redhat_00013.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.10-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-2.Final_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.8-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.11-4.GA_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wss4j +6 | 2.3.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xalan-j2 | 2.7.1-26.redhat_00015.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.2.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-17.redhat_00051.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-apache-sshd | 2.9.3-1.redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-avro | 1.11.3-1.redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-guava +1 | 32.1.1-2.jre_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.20-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.32-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-infinispan +9 | 11.0.18-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.4.4-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec | 2.0.1-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.14-1.SP1_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-33.Final_redhat_00032.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.11-1.SP1_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.9-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 4.2.23-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.28-1.SP1_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.1.10-2.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.14-5.GA_redhat_00002.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.14-5.GA_redhat_00002.1.el8eap | RHSA-2023:7639, RHSA-2023:7638 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.16-1.Final_redhat_00001.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.11-4.redhat_00002.1.el7eap | RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.xnio:xnio-api | < 3.8.14.Final | 3.8.14.Final | GHSA-7f88-5hhx-67m2 |
Advisories 13
- RHSA-2024:10208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:10207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:7639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2024-1642 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2024
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0294 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1488 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2024
References
- RHSA-2023:7637 vendor-advisory
- RHSA-2023:7638 vendor-advisory
- RHSA-2023:7639 vendor-advisory
- RHSA-2023:7641 vendor-advisory
- RHSA-2024:10207 vendor-advisory
- RHSA-2024:10208 vendor-advisory
- RHSA-2024:2707 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-5685 vdb-entry
- RHBZ#2241822 issue-tracking