Read the docs
TI-2020-15705 Aliases CVE-2020-25689GHSA-97hp-6q9g-5cw2

Memory leak in Red Hat wildfly-core

Priority LOW 32CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-401.

Summary

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

Why it matters now

EPSS 0.01487 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.wildfly:wildfly-dist (Maven): 21.0.1Red Hat: 7 advisoriesRed Hat: 7 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatwildfly-coreup to 21.0.0.Final—No fix listedCNA
—org.wildfly:wildfly-dist (Maven)before 21.0.121.0.1Patch availableGHSA-97hp-6q9g-5cw2
  • wildfly-core VendorRed Hat Affected up to 21.0.0.Final Fixed in — No fix listed CNA
  • org.wildfly:wildfly-dist (Maven) Vendor— Affected before 21.0.1 Fixed in 21.0.1 Patch available GHSA-97hp-6q9g-5cw2

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*up to 21.0.0VulnerableRed Hat
cpe:2.3:a:redhat:fuse:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* Versions up to 21.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:fuse:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-97hp-6q9g-5cw2 org.wildfly:wildfly-dist (Maven) Fixed in 21.0.1 Advisory →

Red Hat 7 advisories

  • RHSA-2022:5532 Released 2022-07-07 · Red Hat rating Important
    Red Hat Fuse 7.11.0 release and security update
    • Red Hat Fuse 7.11
  • RHSA-2021:0295 Released 2021-02-08 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.3 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2021:0327 Released 2021-02-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.5 security update
    • Red Hat Single Sign-On 7.4.5
Show 4 more Red Hat advisories
  • RHSA-2021:0248 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el8eap +47
  • RHSA-2021:0247 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el7eap +47
  • RHSA-2021:0246 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el6eap +47
  • RHSA-2021:0250 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Fuse 7.11Fixed RHSA-2022:5532
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0248
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0246
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0247
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0250
Red Hat Single Sign-On 7.4.5Fixed RHSA-2021:0327
Text-Only RHOARFixed RHSA-2021:0295
Not affected: 2 products
  • Red Hat Decision Manager 7
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25689
  2. 2026-10-03 Alias added: GHSA-97hp-6q9g-5cw2

References

Exploit 1

Advisory 2

Other 1

  • TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences