CVE-2022-0853 - jboss-client: memory leakage in remote client transaction

Back Back to CVE browser

HIGH

jboss-client: memory leakage in remote client transaction

Published Mar 11, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.45%

Description

A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.

Affected products

Vendor n/a Product Jboss-Client Default
n/a
- Version
  1.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Jboss-Client

n/a

Version	Status	Constraints
1.7	affected	-

Red Hat JBoss Enterprise Application Platform 7

jboss-client

Fixed · RHSA-2022:4922
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

eap7-wildfly-http-client-0:1.1.11-1.SP1_redhat_00001.1.el8eap

Fixed · RHSA-2022:4919
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

eap7-wildfly-http-client-0:1.1.11-1.SP1_redhat_00001.1.el7eap

Fixed · RHSA-2022:4918
Red Hat Single Sign-On 7.6 for RHEL 7

rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el7sso

Fixed · RHSA-2022:7409
Red Hat Single Sign-On 7.6 for RHEL 8

rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el8sso

Fixed · RHSA-2022:7410
Red Hat Single Sign-On 7.6 for RHEL 9

rh-sso7-0:1-5.el9sso

Fixed · RHSA-2022:7411
Red Hat Single Sign-On 7.6 for RHEL 9

rh-sso7-javapackages-tools-0:6.0.0-7.el9sso

Fixed · RHSA-2022:7411
Red Hat Single Sign-On 7.6 for RHEL 9

rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el9sso

Fixed · RHSA-2022:7411
Red Hat Single Sign-On 7.6.1

n/a

Fixed · RHSA-2022:7417
Red Hat Decision Manager 7

jboss-client

Fix deferred
Red Hat JBoss Enterprise Application Platform 6

jboss-client

Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion Pack

jboss-client

Fix deferred
Red Hat JBoss Fuse 6

jboss-client

Fix deferred
Red Hat JBoss Operations Network 3

jboss-client

Out of support scope
Red Hat OpenShift Container Platform 3.11

jboss-client

Out of support scope
Red Hat Process Automation 7

jboss-client

Fix deferred

Product	Package	State	Advisory
Red Hat JBoss Enterprise Application Platform 7	jboss-client	Fixed	RHSA-2022:4922
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8	eap7-wildfly-http-client-0:1.1.11-1.SP1_redhat_00001.1.el8eap	Fixed	RHSA-2022:4919
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7	eap7-wildfly-http-client-0:1.1.11-1.SP1_redhat_00001.1.el7eap	Fixed	RHSA-2022:4918
Red Hat Single Sign-On 7.6 for RHEL 7	rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el7sso	Fixed	RHSA-2022:7409
Red Hat Single Sign-On 7.6 for RHEL 8	rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el8sso	Fixed	RHSA-2022:7410
Red Hat Single Sign-On 7.6 for RHEL 9	rh-sso7-0:1-5.el9sso	Fixed	RHSA-2022:7411
Red Hat Single Sign-On 7.6 for RHEL 9	rh-sso7-javapackages-tools-0:6.0.0-7.el9sso	Fixed	RHSA-2022:7411
Red Hat Single Sign-On 7.6 for RHEL 9	rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el9sso	Fixed	RHSA-2022:7411
Red Hat Single Sign-On 7.6.1	n/a	Fixed	RHSA-2022:7417
Red Hat Decision Manager 7	jboss-client	Fix deferred	n/a
Red Hat JBoss Enterprise Application Platform 6	jboss-client	Out of support scope	n/a
Red Hat JBoss Enterprise Application Platform Expansion Pack	jboss-client	Fix deferred	n/a
Red Hat JBoss Fuse 6	jboss-client	Fix deferred	n/a
Red Hat JBoss Operations Network 3	jboss-client	Out of support scope	n/a
Red Hat OpenShift Container Platform 3.11	jboss-client	Out of support scope	n/a
Red Hat Process Automation 7	jboss-client	Fix deferred	n/a

Remediation

No remediation recorded yet.

Metrics

1.45% 0.01452

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.01452

Score over time

2022-2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (20 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	1.45% (0.01452)	72.50th	v5 (v2026.06.15)
Jun 15, 2026	1.43% (0.01429)	69.43th	v5 (v2026.06.15)
Aug 8, 2025	1.70% (0.01700)	81.52th	v4 (v2025.03.14)
Mar 30, 2025	0.54% (0.00540)	64.97th	v4 (v2025.03.14)
Mar 29, 2025	5.82% (0.05817)	83.78th	v4 (v2025.03.14)
Mar 28, 2025	0.46% (0.00465)	61.52th	v4 (v2025.03.14)
Mar 27, 2025	5.06% (0.05059)	88.34th	v4 (v2025.03.14)
Mar 20, 2025	0.46% (0.00465)	61.72th	v4 (v2025.03.14)
Mar 19, 2025	5.06% (0.05059)	88.50th	v4 (v2025.03.14)
Mar 17, 2025	0.46% (0.00465)	62.29th	v4 (v2025.03.14)
Dec 12, 2024	0.11% (0.00112)	46.38th	v3 (v2023.03.01)
May 18, 2024	0.08% (0.00081)	34.62th	v3 (v2023.03.01)
Aug 22, 2023	0.08% (0.00078)	32.60th	v3 (v2023.03.01)
Apr 13, 2023	0.07% (0.00071)	28.84th	v3 (v2023.03.01)
Mar 18, 2023	0.06% (0.00063)	24.96th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00053)	19.02th	v3 (v2023.03.01)
Mar 6, 2023	4.50% (0.04499)	88.81th	v2 (v2022.01.01)
Apr 1, 2022	4.50% (0.04499)	87.70th	v2 (v2022.01.01)
Mar 19, 2022	4.50% (0.04499)	74.59th	v2 (v2022.01.01)
Mar 12, 2022	1.40% (0.01404)	49.72th	v2 (v2022.01.01)

Weaknesses (1)

CWE-401

References (5)

https://access.redhat.com/security/cve/CVE-2022-0853
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2060725
x_refsource_MISCIssue TrackingVendor Advisory
https://github.com/ByteHackr/CVE-2022-0853
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0853
https://www.cve.org/CVERecord?id=CVE-2022-0853

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-0853		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2060725		x_refsource_MISCIssue TrackingVendor Advisory
https://github.com/ByteHackr/CVE-2022-0853		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0853
https://www.cve.org/CVERecord?id=CVE-2022-0853

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published Mar 11, 2022

Updated Aug 2, 2024

Reserved Mar 4, 2022

Link CVE-2022-0853

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-0853

Red Hat

Severity Low

Public date Mar 4, 2022

Links CVE-2022-0853 - Bugzilla