Back

HIGH

jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client

Published Jun 2, 2021

Description

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected products

Remediation

No remediation recorded yet.

References (6)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner redhat
Published Jun 2, 2021
Updated Aug 4, 2024
Reserved Dec 17, 2020

CISA Vulnrichment

No data

NVD

Status Modified
Modified Jun 17, 2026

Red Hat

Severity Moderate
Public date Dec 9, 2020
Bugzilla 1905796

ENISA EUVD

Assigner redhat
Published Jun 2, 2021
Updated Aug 4, 2024