Description
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | narayana | < 7.1.0.Final | 7.1.0.Final |
| Red Hat | Red Hat JBoss EAP XP 5.0 Update 2.0 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.6.1-1.GA_redhat_00001.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.119-1.Final_redhat_00002.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.16-2.redhat_00003.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.6-15.GA_redhat_00009.1.el8eap | RHSA-2025:3357 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.narayana.rts:lra-coordinator-jar | < 7.1.0.Final | 7.1.0.Final | GHSA-qq9f-q439-2574 |
Advisories 1
- RHSA-2025:3357 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- RHSA-2025:3357 vendor-advisory
- RHSA-2025:3358 vendor-advisory
- RHSA-2025:7620 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-8447 vdb-entry
- RHBZ#2335206 issue-tracking
- https://github.com/jbosstm/narayana/pull/2293