Read the docs
TI-2010-03669 Aliases CVE-2010-3862GHSA-3f3h-gc4r-7vvp

The…

Priority LOW 18CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0; and JBoss Enterprise Web Platform (aka JBEWP) 5.1.0; allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data.

Why it matters now

EPSS 0.02611 85th percentileScored 2026-11-07
Fix Fixed Red Hat: 8 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_remoting:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp10:*:*:*:*:*:*2.2.2 sp10VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp11:*:*:*:*:*:*2.2.2 sp11VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp2:*:*:*:*:*:*2.2.2 sp2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp4:*:*:*:*:*:*2.2.2 sp4VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp7:*:*:*:*:*:*2.2.2 sp7VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp8:*:*:*:*:*:*2.2.2 sp8VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.3:sp1:*:*:*:*:*:*2.2.3 sp1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_remoting:2.2.3:sp2:*:*:*:*:*:*2.2.3 sp2VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp10:*:*:*:*:*:* Versions 2.2.2 sp10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp11:*:*:*:*:*:* Versions 2.2.2 sp11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp2:*:*:*:*:*:* Versions 2.2.2 sp2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp4:*:*:*:*:*:* Versions 2.2.2 sp4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp7:*:*:*:*:*:* Versions 2.2.2 sp7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.2:sp8:*:*:*:*:*:* Versions 2.2.2 sp8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.3:sp1:*:*:*:*:*:* Versions 2.2.3 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.3:sp2:*:*:*:*:*:* Versions 2.2.3 sp2 Vulnerable ·Red Hat
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_remoting:2.2.3:sp3:*:*:*:*:*:*2.2.3 sp3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp01:*:*:*:*:*:*4.3.0 cp01VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp02:*:*:*:*:*:*4.3.0 cp02VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp03:*:*:*:*:*:*4.3.0 cp03VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp04:*:*:*:*:*:*4.3.0 cp04VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp05:*:*:*:*:*:*4.3.0 cp05VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp06:*:*:*:*:*:*4.3.0 cp06VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp07:*:*:*:*:*:*4.3.0 cp07VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp08:*:*:*:*:*:*4.3.0 cp08VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp09:*:*:*:*:*:*4.3.0 cp09VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_remoting:2.2.3:sp3:*:*:*:*:*:* Versions 2.2.3 sp3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp01:*:*:*:*:*:* Versions 4.3.0 cp01 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp02:*:*:*:*:*:* Versions 4.3.0 cp02 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp03:*:*:*:*:*:* Versions 4.3.0 cp03 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp04:*:*:*:*:*:* Versions 4.3.0 cp04 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp05:*:*:*:*:*:* Versions 4.3.0 cp05 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp06:*:*:*:*:*:* Versions 4.3.0 cp06 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp07:*:*:*:*:*:* Versions 4.3.0 cp07 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp08:*:*:*:*:*:* Versions 4.3.0 cp08 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:cp09:*:*:*:*:*:* Versions 4.3.0 cp09 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Red Hat

Remediation

Red Hat 8 advisories

  • RHSA-2010:0963 Released 2010-12-08 · Red Hat rating Low
    JBoss Enterprise Application Platform 5.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 5.1
  • RHSA-2010:0962 Released 2010-12-08 · Red Hat rating Low
    JBoss Enterprise Web Platform 5.1.0 security update
    • Red Hat JBoss Web Platform 5.1
  • RHSA-2010:0961 Released 2010-12-08 · Red Hat rating Low
    JBoss Enterprise Web Platform 5.1.0 security and bug fix update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server jboss-remoting-2.5.3-5.SP1.1.ep5.el5, jbossws-cxf-3.1.2-4.SP7.6.jdk6.ep5.el5, jopr-embedded-1.3.4-16.SP1.7.ep5.el5
Show 5 more Red Hat advisories
  • RHSA-2010:0960 Released 2010-12-08 · Red Hat rating Low
    JBoss Enterprise Application Platform 5.1.0 security and bug fix update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jboss-remoting-2.5.3-5.SP1.1.ep5.el5, jbossas-security-policy-cc-5.1.0-1.ep5.el5, jbossws-cxf-3.1.2-4.SP7.6.jdk6.ep5.el5 +1
  • RHSA-2010:0959 Released 2010-12-08 · Red Hat rating Low
    JBoss Enterprise Application Platform 5.1.0 security and bug fix update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jboss-remoting-2.5.3-5.SP1.1.ep5.el4, jbossas-security-policy-cc-5.1.0-1.ep5.el4, jbossws-cxf-3.1.2-4.SP7.6.jdk6.ep5.el4 +1
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jboss-remoting-2.5.3-5.SP1.1.ep5.el4, jbossas-security-policy-cc-5.1.0-1.ep5.el4, jbossws-cxf-3.1.2-4.SP7.6.jdk6.ep5.el4 +1
  • RHSA-2010:0939 Released 2010-12-01 · Red Hat rating Important
    JBoss Enterprise Application Platform 4.3.0.CP09 update
    • Red Hat JBoss Enterprise Application Platform 4.3
  • RHSA-2010:0938 Released 2010-12-01 · Red Hat rating Important
    JBoss Enterprise Application Platform 4.3.0.CP09 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server glassfish-jaxb-2.1.4-1.17.patch04.ep1.el5, glassfish-jaxws-2.1.1-1jpp.ep1.13.el5, hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el5 +23
  • RHSA-2010:0937 Released 2010-12-01 · Red Hat rating Important
    JBoss Enterprise Application Platform 4.3.0.CP09 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS glassfish-jaxb-2.1.4-1.17.patch04.ep1.el4, glassfish-jaxws-2.1.1-1jpp.ep1.13.el4, hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4 +22
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES glassfish-jaxb-2.1.4-1.17.patch04.ep1.el4, glassfish-jaxws-2.1.1-1jpp.ep1.13.el4, hibernate3-1:3.2.4-1.SP1_CP11.0jpp.ep2.0.el4 +22

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 4.3Fixed RHSA-2010:0939
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ASFixed RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ESFixed RHSA-2010:0937
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 ServerFixed RHSA-2010:0938
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2010:0959
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2010:0959
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2010:0960
Red Hat JBoss Enterprise Application Platform 5.1Fixed RHSA-2010:0963
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2010:0961
Red Hat JBoss Web Platform 5.1Fixed RHSA-2010:0962
Not affected: 2 products
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS
  • Red Hat JBoss Web Platform 5 for RHEL 4 ES

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-3862
  2. 2026-10-03 Alias added: GHSA-3f3h-gc4r-7vvp

References

Patch 1

Advisory 8

Other 2

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences