Skip to content
Sign in
4.1 Medium

CVE-2024-4029 Wildfly: no timeout for eap management interface may lead to denial of service (dos)

Description

A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitable with local access to the machine, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
High
Privileges required
High
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected products and versions

Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat Data Grid 8 Versions not published
Show the 6 other branches
Product Affected versions Fixed in
Red Hat Fuse 7 Versions not published
Red Hat JBoss Data Grid 7 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat JBoss Enterprise Application Platform 15.0 earliest → < 15.0.39.Final-redhat-00001 15.0.39.Final-redhat-00001

Other CVEs of Red Hat JBoss Enterprise Application Platform 7

The 168 CVEs of Red Hat JBoss Enterprise Application Platform 7 →
CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow 6.5 Medium CVE-2026-114488 Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding 7.4 High
Track this CVE