Read the docs
TI-2020-15661 Aliases CVE-2020-25644GHSA-hxj4-885f-grgp

Memory leak in wildfly-openssl

Priority LOW 37CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-401.

Summary

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

Why it matters now

EPSS 0.02365 83rd percentileScored 2026-11-07
Fix Partial org.wildfly.openssl:wildfly-openssl-natives-parent (Maven): 1.1.3.FinalRed Hat: 13 advisoriesRed Hat: 10 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—wildfly-opensslbefore wildfly-openssl 1.1.3.Final—No fix listedCNA
—org.wildfly.openssl:wildfly-openssl-natives-parent (Maven)before 1.1.3.Final1.1.3.FinalPatch availableGHSA-hxj4-885f-grgp
  • wildfly-openssl Vendor— Affected before wildfly-openssl 1.1.3.Final Fixed in — No fix listed CNA
  • org.wildfly.openssl:wildfly-openssl-natives-parent (Maven) Vendor— Affected before 1.1.3.Final Fixed in 1.1.3.Final Patch available GHSA-hxj4-885f-grgp

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly_openssl:*:*:*:*:*:*:*:*before 1.1.3VulnerableRed Hat
cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:redhat:wildfly_openssl:*:*:*:*:*:*:*:* Versions before 1.1.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-hxj4-885f-grgp org.wildfly.openssl:wildfly-openssl-natives-parent (Maven) Fixed in 1.1.3.Final Advisory →

Red Hat 13 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:0433 Released 2021-02-08 · Red Hat rating Moderate
    Red Hat Data Grid 8.1.1 security update
    • Red Hat Data Grid 8.1.1
Show 10 more Red Hat advisories
  • RHSA-2020:5410 Released 2020-12-14 · Red Hat rating Important
    Red Hat Data Grid 7.3.8 security update
    • Red Hat Data Grid 7.3.8
  • RHSA-2020:5342 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el8eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el8eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el8eap +47
  • RHSA-2020:5341 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el7eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el7eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el7eap +47
  • RHSA-2020:5340 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-6.redhat_00016.1.el6eap, eap7-activemq-artemis-cli-2.9.0-6.redhat_00016.1.el6eap, eap7-activemq-artemis-commons-2.9.0-6.redhat_00016.1.el6eap +47
  • RHSA-2020:5344 Released 2020-12-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.4 security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:4978 Released 2020-11-09 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.3 one-off security update
    • Red Hat Single Sign-On 7.4.3 one-off
  • RHSA-2020:4922 Released 2020-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el8eap
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el6eap
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wildfly-openssl-linux-x86_64-1.0.12-1.Final_redhat_00001.1.el7eap
  • RHSA-2020:4923 Released 2020-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.3 security update
    • EAP 7.3.3
  • RHSA-2020:4256 Released 2020-10-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wildfly-openssl-linux-x86_64-1.0.11-1.Final_redhat_00001.1.el8eap
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wildfly-openssl-linux-x86_64-1.0.11-1.Final_redhat_00001.1.el6eap
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wildfly-openssl-linux-x86_64-1.0.11-1.Final_redhat_00001.1.el7eap
  • RHSA-2020:4257 Released 2020-10-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Application RuntimesAffectedNo fix yet
EAP 7.3.3Fixed RHSA-2020:4923
Red Hat Data Grid 7.3.8Fixed RHSA-2020:5410
Red Hat Data Grid 8.1.1Fixed RHSA-2021:0433
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:4256, RHSA-2020:4922, RHSA-2020:5342
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:4256, RHSA-2020:4922, RHSA-2020:5340
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:4256, RHSA-2020:4922, RHSA-2020:5341
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:4257
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat Single Sign-On 7.4.3 one-offFixed RHSA-2020:4978
Not affected: 2 products
  • Red Hat Decision Manager 7
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25644
  2. 2026-10-03 Alias added: GHSA-hxj4-885f-grgp

References

Patch 2

Advisory 3

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences