Read the docs
TI-2017-08964 Aliases CVE-2017-12174GHSA-gc96-h5pr-839j

Uncontrolled resource consumption in Red Hat HornetQ/Artemis

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.

Why it matters now

EPSS 0.05976 93rd percentileScored 2026-11-07
Fix Fixed org.hornetq:hornetq-server (Maven): 2.4.0.Finalorg.apache.activemq:artemis-native (Maven): 2.4.0Red Hat: 10 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatHornetQ/Artemisbefore 2.4.02.4.0Patch availableCNA
—org.hornetq:hornetq-server (Maven)before 2.4.0.Final2.4.0.FinalPatch availableGHSA-gc96-h5pr-839j
—org.apache.activemq:artemis-native (Maven)before 2.4.02.4.0Patch availableGHSA-gc96-h5pr-839j
  • HornetQ/Artemis VendorRed Hat Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
  • org.hornetq:hornetq-server (Maven) Vendor— Affected before 2.4.0.Final Fixed in 2.4.0.Final Patch available GHSA-gc96-h5pr-839j
  • org.apache.activemq:artemis-native (Maven) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-gc96-h5pr-839j

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*before 2.4.0VulnerableApache
cpe:2.3:a:redhat:hornetq:*:*:*:*:*:*:*:*before 2.4.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0Running onRed Hat
  • cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·Apache
  • cpe:2.3:a:redhat:hornetq:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat

Remediation

  • Fix · GHSA-gc96-h5pr-839j org.hornetq:hornetq-server (Maven) Fixed in 2.4.0.Final Advisory →
  • Fix · GHSA-gc96-h5pr-839j org.apache.activemq:artemis-native (Maven) Fixed in 2.4.0 Advisory →

Red Hat 10 advisories

  • RHSA-2020:2561 Released 2020-06-15 · Red Hat rating Critical
    EAP Continuous Delivery Technical Preview Release 12 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • RHSA-2018:0481 Released 2018-03-12 · Red Hat rating Important
    jboss-ec2-eap package for EAP 7.1.1
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.1-3.1.GA_redhat_3.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.1-3.1.GA_redhat_3.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.1-3.1.GA_redhat_3.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.1-3.1.GA_redhat_3.ep7.el7
  • RHSA-2018:0479 Released 2018-03-12 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.1 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.009-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.009-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.009-1.redhat_1.1.ep7.el6 +47
Show 7 more Red Hat advisories
  • RHSA-2018:0480 Released 2018-03-12 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.1 for RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.009-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.009-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.009-1.redhat_1.1.ep7.el7 +47
  • RHSA-2018:0478 Released 2018-03-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.1 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2018:0275 Released 2018-02-05 · Red Hat rating Important
    jboss-ec2-eap security, bug fix, and enhancement update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.19-2.Final_redhat_2.ep6.el6, jboss-ec2-eap-samples-7.5.19-2.Final_redhat_2.ep6.el6
  • RHSA-2018:0271 Released 2018-02-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.19 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server hornetq-2.3.25-25.SP23_redhat_1.1.ep6.el5, infinispan-5.2.23-1.Final_redhat_1.1.ep6.el5, infinispan-cachestore-jdbc-5.2.23-1.Final_redhat_1.1.ep6.el5 +47
  • RHSA-2018:0268 Released 2018-02-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.19 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq-2.3.25-25.SP23_redhat_1.1.ep6.el7, infinispan-5.2.23-1.Final_redhat_1.1.ep6.el7, infinispan-cachestore-jdbc-5.2.23-1.Final_redhat_1.1.ep6.el7 +47
  • RHSA-2018:0270 Released 2018-02-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.19 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq-2.3.25-25.SP23_redhat_1.1.ep6.el6, infinispan-5.2.23-1.Final_redhat_1.1.ep6.el6, infinispan-cachestore-jdbc-5.2.23-1.Final_redhat_1.1.ep6.el6 +47
  • RHSA-2018:0269 Released 2018-02-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.19 security update
    • Red Hat JBoss Enterprise Application Platform 6.4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss EAP 7.1Fixed RHSA-2018:0478
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2018:0269
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2018:0271
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2018:0270, RHSA-2018:0275
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2018:0268
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2018:0479, RHSA-2018:0481
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2018:0480, RHSA-2018:0481
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2561
Not affected: 1 product
  • Red Hat JBoss Operations Network 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12174
  2. 2026-10-03 Alias added: GHSA-gc96-h5pr-839j
  3. 2026-11-05 Fix available: Red Hat JBoss EAP 7.1 · Red Hat

References

Advisory 11

Other 4

  • TI-2024-34252 An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily… CVSS 3.1CRITICAL 9.1
  • TI-2014-02922 HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences