Read the docs
TI-2020-08639 Aliases CVE-2020-10740GHSA-vrmw-2xhq-hrmp

Deserialization of untrusted data in [UNKNOWN] wildfly

Priority LOW 37CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 13 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

Why it matters now

EPSS 0.02067 81st percentileScored 2026-11-08
Fix Partial wildfly ([UNKNOWN]): 20.0.0.Finalorg.wildfly:wildfly-parent (Maven): 20.0.0.FinalRed Hat: 17 advisoriesRed Hat: 13 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]wildflybefore 20.0.0.Final20.0.0.FinalPatch availableCNA
—org.wildfly:wildfly-parent (Maven)before 20.0.0.Final20.0.0.FinalPatch availableGHSA-vrmw-2xhq-hrmp
  • wildfly Vendor[UNKNOWN] Affected before 20.0.0.Final Fixed in 20.0.0.Final Patch available CNA
  • org.wildfly:wildfly-parent (Maven) Vendor— Affected before 20.0.0.Final Fixed in 20.0.0.Final Patch available GHSA-vrmw-2xhq-hrmp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*before 20.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions before 20.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · CNA wildfly ([UNKNOWN]) Fixed in 20.0.0.Final
  • Fix · GHSA-vrmw-2xhq-hrmp org.wildfly:wildfly-parent (Maven) Fixed in 20.0.0.Final Advisory →

Red Hat 17 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0
  • RHSA-2020:3642 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 security update
    • Red Hat JBoss Enterprise Application Platform 7
Show 14 more Red Hat advisories
  • RHSA-2020:3638 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el7eap +47
  • RHSA-2020:3639 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el8eap +47
  • RHSA-2020:3637 Released 2020-09-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el6eap +47
  • RHSA-2020:3539 Released 2020-09-02 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:3585 Released 2020-08-31 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 20 security update
    • EAP-CD 20 Tech Preview
  • RHSA-2020:3501 Released 2020-08-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.2 security update
    • Red Hat Single Sign-On 7.4.2
  • RHSA-2020:3463 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el8eap +47
  • RHSA-2020:3462 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el7eap +47
  • RHSA-2020:3461 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el6eap +47
  • RHSA-2020:3464 Released 2020-08-17 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.2 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:3142 Released 2020-07-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el6eap, eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el6eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el6eap +7
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el7eap, eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el7eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el7eap +9
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el8eap, eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el8eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el8eap +7
  • RHSA-2020:3141 Released 2020-07-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el8eap, eap7-wildfly-7.3.1-7.GA_redhat_00004.1.el8, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el8eap +7
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el6eap, eap7-wildfly-7.3.1-7.GA_redhat_00004.1.el6eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el6eap +7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el7eap, eap7-wildfly-7.3.1-7.GA_redhat_00004.1.el7eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el7eap +9
  • RHSA-2020:3144 Released 2020-07-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2020:3143 Released 2020-07-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix yet: Fix deferred
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
EAP-CD 20 Tech PreviewFixed RHSA-2020:3585
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568
Red Hat JBoss EAP 7.2Fixed RHSA-2020:3144
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:3142, RHSA-2020:3637
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:3142, RHSA-2020:3638
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:3142, RHSA-2020:3639
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:3141, RHSA-2020:3463
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:3141, RHSA-2020:3461
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:3141, RHSA-2020:3462
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:3143
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat Single Sign-On 7.4.2Fixed RHSA-2020:3501
Text-Only RHOARFixed RHSA-2020:3539
Not affected: 4 products
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat JBoss Data Grid 7
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10740
  2. 2026-10-03 Alias added: GHSA-vrmw-2xhq-hrmp

References

Advisory 2

Other 1

  • TI-2018-07554 An issue was discovered in WildFly 10.1.2.Final. CVSS 3.1CRITICAL 9.8
  • TI-2019-11091 A flaw was found when an OpenSSL security provider is used with Wildfly, the… CVSS 3.1CRITICAL 9.1
  • TI-2019-02903 It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in… CVSS 3.1HIGH 8.8
  • TI-2020-08617 A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded… CVSS 3.1HIGH 7.5
  • TI-2022-01162 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and… CVSS 3.1HIGH 7.5
  • TI-2020-15705 Memory leak in Red Hat wildfly-core CVSS 3.1MEDIUM 6.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences