Uncontrolled resource consumption in Red Hat wildfly
Priority LOW 31CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01203 68th percentileScored 2026-11-07
Fix Partial org.jboss:jboss-ejb-client (Maven): 4.0.34.FinalRed Hat: 16 advisoriesRed Hat: 12 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | wildfly | jboss-ejb-client as shipped with Red Hat JBoss EAP 7 | — | No fix listed | CNA |
| — | org.jboss:jboss-ejb-client (Maven) | before 4.0.34.Final | 4.0.34.Final | Patch available | GHSA-qcch-9268-59jw |
- wildfly VendorRed Hat Affected jboss-ejb-client as shipped with Red Hat JBoss EAP 7 Fixed in — No fix listed CNA
- org.jboss:jboss-ejb-client (Maven) Vendor— Affected before 4.0.34.Final Fixed in 4.0.34.Final Patch available GHSA-qcch-9268-59jw
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:* | 1.0.0 to before 4.0.34 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:* Versions 1.0.0 to before 4.0.34 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-qcch-9268-59jw org.jboss:jboss-ejb-client (Maven) Fixed in 4.0.34.Final Advisory →
Red Hat 16 advisories
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
- RHSA-2020:3817 Released 2020-09-23 · Red Hat rating ModerateAMQ Clients 2.8.0 Release
- Red Hat AMQ Clients 2 nodejs-rhea-1.0.24-1.el8, python-qpid-proton-0.32.0-1.el6_10, python-qpid-proton-0.32.0-2.el7 +38
- RHSA-2020:3642 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 security update
- Red Hat JBoss Enterprise Application Platform 7
Show 13 more Red Hat advisories
- RHSA-2020:3638 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el7eap +47
- RHSA-2020:3639 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el8eap +47
- RHSA-2020:3637 Released 2020-09-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.2.5-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.5-13.SP3_redhat_00011.1.el6eap +47
- RHSA-2020:3539 Released 2020-09-02 · Red Hat rating ImportantRed Hat build of Thorntail 2.7.1 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:3501 Released 2020-08-18 · Red Hat rating ImportantRed Hat Single Sign-On 7.4.2 security update
- Red Hat Single Sign-On 7.4.2
- RHSA-2020:3463 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j-2.1.3-1.redhat_00001.1.el8eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el8eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el8eap +47
- RHSA-2020:3462 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el7eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el7eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el7eap +47
- RHSA-2020:3461 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j-2.1.3-1.redhat_00001.1.el6eap, eap7-elytron-web-1.6.2-1.Final_redhat_00001.1.el6eap, eap7-glassfish-jsf-2.3.9-11.SP11_redhat_00001.1.el6eap +47
- RHSA-2020:3464 Released 2020-08-17 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.2 security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2020:3142 Released 2020-07-23 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el6eap, eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el6eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el6eap +7
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el7eap, eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el7eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el7eap +9
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el8eap, eap7-wildfly-7.2.8-6.GA_redhat_00003.1.el8eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el8eap +7
- RHSA-2020:3141 Released 2020-07-23 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3 security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el8eap, eap7-wildfly-7.3.1-7.GA_redhat_00004.1.el8, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el8eap +7
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el6eap, eap7-wildfly-7.3.1-7.GA_redhat_00004.1.el6eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el6eap +7
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jboss-ejb-client-4.0.33-2.SP1_redhat_00001.1.el7eap, eap7-wildfly-7.3.1-7.GA_redhat_00004.1.el7eap, eap7-wildfly-http-client-1.0.21-1.Final_redhat_00001.1.el7eap +9
- RHSA-2020:3144 Released 2020-07-23 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2 security update
- Red Hat JBoss EAP 7.2
- RHSA-2020:3143 Released 2020-07-23 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3 security update
- Red Hat JBoss Enterprise Application Platform 7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat AMQ Clients 2 | Fixed | RHSA-2020:3817 |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2020:3144 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:3142, RHSA-2020:3637 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:3142, RHSA-2020:3638 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:3142, RHSA-2020:3639 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2020:3141, RHSA-2020:3463 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2020:3141, RHSA-2020:3461 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2020:3141, RHSA-2020:3462 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2020:3143 |
| Red Hat Single Sign-On 7.4.2 | Fixed | RHSA-2020:3501 |
| Text-Only RHOAR | Fixed | RHSA-2020:3539 |
Not affected: 3 products
- Red Hat Data Grid 8
- Red Hat Decision Manager 7
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-14297
- 2026-10-03 Alias added: GHSA-qcch-9268-59jw
References
Advisory 2
Other 22
- https://github.com/wildfly/jboss-ejb-client/commit/e5f8e4b591f1698a53adc7e430584ca2a8fc9f1b
- https://github.com/wildfly/jboss-ejb-client/commits/4.0.34.Final
- https://github.com/wildfly/jboss-ejb-client
- https://bugzilla.redhat.com/show_bug.cgi?id=1853595
- https://access.redhat.com/solutions/21906
- https://access.redhat.com/security/cve/CVE-2020-14297
- https://access.redhat.com/errata/RHSA-2021:3140
- https://access.redhat.com/errata/RHSA-2020:3817
- https://access.redhat.com/errata/RHSA-2020:3642
- https://access.redhat.com/errata/RHSA-2020:3639
- https://access.redhat.com/errata/RHSA-2020:3638
- https://access.redhat.com/errata/RHSA-2020:3637
- https://access.redhat.com/errata/RHSA-2020:3539
- https://access.redhat.com/errata/RHSA-2020:3501
- https://access.redhat.com/errata/RHSA-2020:3464
- https://access.redhat.com/errata/RHSA-2020:3463
- https://access.redhat.com/errata/RHSA-2020:3462
- https://access.redhat.com/errata/RHSA-2020:3461
- https://access.redhat.com/errata/RHSA-2020:3144
- https://access.redhat.com/errata/RHSA-2020:3143
- https://access.redhat.com/errata/RHSA-2020:3142
- https://access.redhat.com/errata/RHSA-2020:3141
More Red Hat Amq vulnerabilities
- TI-2015-04350 Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ. CVSS 3.1HIGH 8.8
- TI-2015-04351 Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. CVSS 3.1HIGH 7.5
- TI-2022-01162 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and… CVSS 3.1HIGH 7.5
- TI-2015-04352 Console: CORS headers set to allow all in Red Hat AMQ. CVSS 3.1HIGH 7.5
- TI-2020-11178 A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-14297 · CVE Program
- CVE-2020-14297 · NVD
- FIRST EPSS
- GHSA-qcch-9268-59jw · GitHub Advisory Database · CC BY 4.0
- CVE-2020-14297 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences