Skip to content
OpenAdvisories
Medium · 4.1 CVE-2024-4029 EUVD-2024-1854GHSA-x7g6-rwhc-g7mj

Wildfly: no timeout for eap management interface may lead to denial of service (dos)

Published May 2, 2024 · Updated Nov 7, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Build of Keycloak Product: Red Hat Data Grid 8 Product: Red Hat Fuse 7 Product: Red Hat JBoss Data Grid 7 Product: Red Hat JBoss Enterprise Application Platform Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Product: Red Hat JBoss Enterprise Application Platform 8 Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Product: Red Hat JBoss Enterprise Application Platform Expansion Pack Product: Red Hat Process Automation 7 Product: Red Hat Single Sign-On 7 Package: org.wildfly:wildfly-domain-http Ecosystem: Maven

Description

A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.

Affected products

VendorProductAffectedFixed
— wildfly < 24.0.1.Final 24.0.1.Final
Red Hat Red Hat JBoss Enterprise Application Platform — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Data Grid 8 — —
Red Hat Red Hat Fuse 7 — —
Red Hat Red Hat JBoss Data Grid 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Process Automation 7 — —
Red Hat Red Hat Single Sign-On 7 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.33.0-1.redhat_00015.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-aesh-extensions 1.8.0-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-aesh-readline 2.2.0-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-codec 1.16.1-2.redhat_00007.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-collections 3.2.2-28.redhat_2.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-io 2.15.1-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-lang 3.14.0-2.redhat_00006.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.5-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-artemis-native +2 1:2.0.0-2.redhat_00005.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-artemis-wildfly-integration 2.0.1-1.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-asyncutil 0.1.0-2.redhat_00010.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-aws-java-sdk +4 1.12.284-2.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-cryptacular 1.2.5-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.4.0-1.GA_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-fastinfoset 2.1.0-4.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-hibernate +2 6.2.31-1.Final_redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-hibernate-validator +1 8.0.1-3.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-hppc 0.8.1-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jakarta-servlet-jsp-jstl +1 3.0.1-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jboss-cert-helper +1 1.1.3-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jboss-logging 3.5.3-1.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jctools +1 4.0.2-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jgroups 5.3.10-1.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-log4j 2.22.1-1.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-narayana +8 6.0.3-1.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-nimbus-jose-jwt 9.37.3-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-objectweb-asm +1 9.6.0-1.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-pem-keystore 2.3.0-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-resteasy-extensions +1 2.0.1-3.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-resteasy-spring 3.0.1-2.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-saaj-impl 3.0.4-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-shibboleth-java-support 8.0.0-6.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.16-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-snakeyaml 2.2.0-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-wildfly +4 8.0.4-2.GA_redhat_00005.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 7 eap7-hal-console 3.3.24-1.Final_redhat_00001.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-hibernate-validator +1 6.0.23-2.SP1_redhat_00001.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.18-1.Final_redhat_00001.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-jboss-cert-helper +1 1.1.3-1.redhat_00001.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.55-1.Final_redhat_00001.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-39.Final_redhat_00039.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-jbossws-cxf 5.4.12-1.Final_redhat_00001.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-jsoup 1.15.4-1.redhat_00003.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-undertow-jastow 2.0.15-1.Final_redhat_00001.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.19-1.GA_redhat_00002.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.19-1.GA_redhat_00002.1.el8eap RHSA-2024:8077, RHSA-2024:8076
Red Hat JBoss EAP 7 eap7-xalan-j2 2.7.1-37.redhat_00015.1.el7eap RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly:wildfly-domain-http <= 24.0.0.Final — GHSA-x7g6-rwhc-g7mj

Advisories 6

References