GitHub Advisoryadvisory · Maven

GHSA-97hp-6q9g-5cw2 Uncontrolled Resource Consumption in WildFly

MEDIUM Published 2022-05-24 Modified 2022-06-23 Official page ↗
Aliases
CVE-2020-25689
Ecosystem
Maven
Packages
org.wildfly:wildfly-dist
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-401
Reviewed
2022-06-23

Affected packages

• Maven org.wildfly:wildfly-dist: < 21.0.1 → fixed in 21.0.1

Description

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

Related

Alias · CVE (1)

  • CVE-2020-25689 A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References