CVE-2024-4029

Wildfly: no timeout for eap management interface may lead to denial of service (dos)

Published May 2, 2024 CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.

Remediation

Vendor Workaround

Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-1854 A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.
Github GHSA Github GHSA GHSA-x7g6-rwhc-g7mj Wildfly vulnerable to denial of service
History
Type Values Removed Values Added
First Time appeared Redhat jboss Bpms
CPEs cpe:/a:redhat:jboss_enterprise_bpms_platform:7 cpe:/a:redhat:jboss_bpms:7
Vendors & Products Redhat jboss Enterprise Bpms Platform
Redhat jboss Bpms
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.0
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak:22 cpe:/a:redhat:build_keycloak:
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 7, 2026, 11:32 AM
Reserved
Apr 22, 2024, 1:59 PM
Status
Deferred
Published
May 2, 2024, 3:15 PM
Modified
Nov 6, 2026, 3:17 PM
Severity
Low
Public date
May 2, 2024, 12:00 AM