Read the docs
TI-2016-07810 Aliases CVE-2016-9589GHSA-p4xg-cpr9-vwvj

Uncontrolled resource consumption in Red Hat wildfly

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.

Why it matters now

EPSS 0.02965 87th percentileScored 2026-11-07
Fix Fixed org.wildfly:wildfly-undertow (Maven): 11.0.0.Beta1Red Hat: 11 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatwildfly11.0.0.Beta1—No fix listedCNA
—org.wildfly:wildfly-undertow (Maven)before 11.0.0.Beta111.0.0.Beta1Patch availableGHSA-p4xg-cpr9-vwvj
  • wildfly VendorRed Hat Affected 11.0.0.Beta1 Fixed in — No fix listed CNA
  • org.wildfly:wildfly-undertow (Maven) Vendor— Affected before 11.0.0.Beta1 Fixed in 11.0.0.Beta1 Patch available GHSA-p4xg-cpr9-vwvj

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_wildfly_application_server:*:*:*:*:*:*:*:*up to 10.1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_wildfly_application_server:11.0.0:alpha1:*:*:*:*:*:*11.0.0 alpha1VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_wildfly_application_server:*:*:*:*:*:*:*:* Versions up to 10.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_wildfly_application_server:11.0.0:alpha1:*:*:*:*:*:* Versions 11.0.0 alpha1 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-p4xg-cpr9-vwvj org.wildfly:wildfly-undertow (Maven) Fixed in 11.0.0.Beta1 Advisory →

Red Hat 11 advisories

  • RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
  • RHSA-2017:3455 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
  • RHSA-2017:3454 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
Show 8 more Red Hat advisories
  • RHSA-2017:3456 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2017:0872 Released 2017-04-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.1 update on RHEL 6
    • Red Hat Single Sign-On 7.1 for RHEL 6 Server rh-sso7-1-2.jbcs.el6, rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el6, rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el6 +13
  • RHSA-2017:0873 Released 2017-04-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.1 update on RHEL 7
    • Red Hat Single Sign-On 7.1 for RHEL 7 Server rh-sso7-1-2.jbcs.el7, rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el7, rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el7 +13
  • RHSA-2017:0876 Released 2017-04-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.1 update
    • Red Hat Single Sign-On 7.1
  • RHSA-2017:0834 Released 2017-03-22 · Red Hat rating Important
    jboss-ec2-eap package for EAP 7.0.5
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.5-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.5-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.5-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.5-1.GA_redhat_1.ep7.el7
  • RHSA-2017:0831 Released 2017-03-22 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.0.5 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-16.SP19_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-16.SP19_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-16.SP19_redhat_1.1.ep7.el6 +47
  • RHSA-2017:0832 Released 2017-03-22 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.0.5 on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-16.SP19_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-16.SP19_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-16.SP19_redhat_1.1.ep7.el7 +47
  • RHSA-2017:0830 Released 2017-03-22 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss EAP 7.0Fixed RHSA-2017:0830
Red Hat JBoss EAP 7.1Fixed RHSA-2017:3456
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:0831, RHSA-2017:0834
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:0832, RHSA-2017:0834
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2017:3454, RHSA-2017:3458
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2017:3455, RHSA-2017:3458
Red Hat Single Sign-On 7.1Fixed RHSA-2017:0876
Red Hat Single Sign-On 7.1 for RHEL 6 ServerFixed RHSA-2017:0872
Red Hat Single Sign-On 7.1 for RHEL 7 ServerFixed RHSA-2017:0873

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9589
  2. 2026-10-03 Alias added: GHSA-p4xg-cpr9-vwvj
  3. 2026-11-06 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat

References

Advisory 12

Other 3

  • TI-2016-00710 Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly… CVSS 3.0HIGH 7.5
  • TI-2015-02829 The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows… CVSS 3.0HIGH 7.5
  • TI-2016-04313 CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red… CVSS 3.0MEDIUM 6.1
  • TI-2015-04356 Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red… CVSS 2.0MEDIUM 6.8
  • TI-2015-04382 The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly… CVSS 2.0MEDIUM 5.0
  • TI-2018-00968 Improper input validation in Red Hat Wildfly CVSS 3.0MEDIUM 5.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences