Read the docs
TI-2011-01303 Aliases CVE-2011-1483GHSA-rj4p-7mm6-gm9j

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application…

Priority LOW 28CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 23 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Why it matters now

EPSS 0.02664 85th percentileScored 2026-11-07
Fix Partial org.jboss.ws:jbossws-common (Maven): 2.1.0.FinalRed Hat: 13 advisoriesRed Hat: 23 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jboss.ws:jbossws-common (Maven)before 2.1.0.Final2.1.0.FinalPatch availableGHSA-rj4p-7mm6-gm9j
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jboss.ws:jbossws-common (Maven) Vendor— Affected before 2.1.0.Final Fixed in 2.1.0.Final Patch available GHSA-rj4p-7mm6-gm9j

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_communications_platform:1.2.11:*:*:*:*:*:*:*1.2.11VulnerableRed Hat
cpe:2.3:a:redhat:jboss_communications_platform:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp09:*:*:*:*:*:*4.2.0 cp09VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:cp06:*:*:*:*:*:*4.3.0 cp06VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp05:*:*:*:*:*:*4.2.0 cp05VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp05:*:*:*:*:*:*4.3.0 cp05VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_communications_platform:1.2.11:*:*:*:*:*:*:* Versions 1.2.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_communications_platform:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.2.0:cp09:*:*:*:*:*:* Versions 4.2.0 cp09 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:cp06:*:*:*:*:*:* Versions 4.3.0 cp06 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.2.0:cp05:*:*:*:*:*:* Versions 4.2.0 cp05 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:cp05:*:*:*:*:*:* Versions 4.3.0 cp05 Vulnerable ·Red Hat
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableRed Hat
cpe:2.3:a:hp:network_node_manager_i:9.0:*:*:*:*:*:*:*9.0VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:network_node_manager_i:9.01:*:*:*:*:*:*:*9.01VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:network_node_manager_i:9.02:*:*:*:*:*:*:*9.02VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:network_node_manager_i:9.03:*:*:*:*:*:*:*9.03VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:network_node_manager_i:9.10:*:*:*:*:*:*:*9.10VulnerableHewlett Packard Enterprise
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:hp:network_node_manager_i:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:network_node_manager_i:9.01:*:*:*:*:*:*:* Versions 9.01 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:network_node_manager_i:9.02:*:*:*:*:*:*:* Versions 9.02 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:network_node_manager_i:9.03:*:*:*:*:*:*:* Versions 9.03 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:network_node_manager_i:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Hewlett Packard Enterprise

Remediation

  • Fix · GHSA-rj4p-7mm6-gm9j org.jboss.ws:jbossws-common (Maven) Fixed in 2.1.0.Final Advisory →

Red Hat 13 advisories

  • RHSA-2011:1313 Released 2011-09-15 · Red Hat rating Important
    JBoss Enterprise BRMS Platform 5.1.0 security update
    • JBoss Enterprise BRMS Platform 5.1
  • RHSA-2011:1312 Released 2011-09-15 · Red Hat rating Important
    jbossws-common security update
    • Red Hat JBoss Enterprise Application Platform 4.3
  • RHSA-2011:1309 Released 2011-09-15 · Red Hat rating Important
    jbossas security update
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jbossas-4.2.0-6.GA_CP09.11.ep1.el4, jbossas-4.2.0.GA_CP09-bin-4.2.0-6.GA_CP09.11.ep1.el4, jbossas-client-4.2.0-6.GA_CP09.11.ep1.el4
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jbossas-4.2.0-6.GA_CP09.11.ep1.el4, jbossas-4.2.0.GA_CP09-bin-4.2.0-6.GA_CP09.11.ep1.el4, jbossas-client-4.2.0-6.GA_CP09.11.ep1.el4
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jbossas-4.2.0-6.GA_CP09.11.1.ep1.el5, jbossas-4.2.0.GA_CP09-bin-4.2.0-6.GA_CP09.11.1.ep1.el5, jbossas-client-4.2.0-6.GA_CP09.11.1.ep1.el5
Show 10 more Red Hat advisories
  • RHSA-2011:1311 Released 2011-09-15 · Red Hat rating Important
    jbossws-common security update
    • Red Hat JBoss Portal 5
  • RHSA-2011:1310 Released 2011-09-15 · Red Hat rating Important
    jbossws security update
    • Red Hat JBoss Enterprise Application Platform 4.2
  • RHSA-2011:1308 Released 2011-09-15 · Red Hat rating Important
    JBoss Communications Platform 1.2.11 and 5.1.1 security update
    • JBoss Communications Platform 1.2
    • JBoss Communications Platform 5.1
  • RHSA-2011:1307 Released 2011-09-15 · Red Hat rating Important
    jbossws security update
    • Red Hat JBoss Enterprise Application Platform 4.3
  • RHSA-2011:1305 Released 2011-09-15 · Red Hat rating Important
    jbossws security update
    • Red Hat JBoss SOA Platform 4.2
    • Red Hat JBoss SOA Platform 4.3
    • Red Hat JBoss SOA Platform 5.1
  • RHSA-2011:1306 Released 2011-09-15 · Red Hat rating Important
    jbossws-common security update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jbossws-common-1.0.0-5.GA_CP07_patch_01.1.ep1.el4
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jbossws-common-1.0.0-5.GA_CP07_patch_01.1.ep1.el4
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jbossws-common-1.0.0-5.GA_CP07_patch_01.1.ep1.el5
  • RHSA-2011:1304 Released 2011-09-15 · Red Hat rating Important
    jbossws-common security update
    • Red Hat JBoss Web Platform 5.1
  • RHSA-2011:1303 Released 2011-09-15 · Red Hat rating Important
    jbossws-common security update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server jbossws-common-1.1.0-4.SP7_patch_02.1.ep5.el5
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server jbossws-common-1.1.0-4.SP7_patch_02.1.ep5.el6
  • RHSA-2011:1302 Released 2011-09-15 · Red Hat rating Important
    jbossws-common security update
    • Red Hat JBoss Enterprise Application Platform 5.1
  • RHSA-2011:1301 Released 2011-09-15 · Red Hat rating Important
    jbossws-common security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jbossws-common-1.1.0-4.SP7_patch_02.1.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jbossws-common-1.1.0-4.SP7_patch_02.1.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jbossws-common-1.1.0-4.SP7_patch_02.1.ep5.el5
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jbossws-common-1.1.0-4.SP7_patch_02.1.ep5.el6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix yet
JBoss Communications Platform 1.2Fixed RHSA-2011:1308
JBoss Communications Platform 5.1Fixed RHSA-2011:1308
JBoss Enterprise BRMS Platform 5.1Fixed RHSA-2011:1313
Red Hat JBoss Enterprise Application Platform 4.2Fixed RHSA-2011:1310
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ASFixed RHSA-2011:1309
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ESFixed RHSA-2011:1309
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 ServerFixed RHSA-2011:1309
Red Hat JBoss Enterprise Application Platform 4.3Fixed RHSA-2011:1307
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ASFixed RHSA-2011:1306
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ESFixed RHSA-2011:1306
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 ServerFixed RHSA-2011:1306
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2011:1301
Red Hat JBoss Enterprise Application Platform 5.1Fixed RHSA-2011:1302
Red Hat JBoss Portal 5Fixed RHSA-2011:1311
Red Hat JBoss SOA Platform 4.2Fixed RHSA-2011:1305
Red Hat JBoss SOA Platform 4.3Fixed RHSA-2011:1305
Red Hat JBoss SOA Platform 5.1Fixed RHSA-2011:1305
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2011:1303
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2011:1303
Red Hat JBoss Web Platform 5.1Fixed RHSA-2011:1304
Not affected: 2 products
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS
  • Red Hat JBoss Web Platform 5 for RHEL 4 ES

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-1483
  2. 2026-10-03 Alias added: GHSA-rj4p-7mm6-gm9j

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences