Read the docs
TI-2020-16893 Aliases CVE-2020-27822GHSA-qx3p-9mmp-4v8h

Memory leak in wildfly

Priority LOW 29CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-401.

Summary

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.

Why it matters now

EPSS 0.01122 66th percentileScored 2026-11-07
Fix Partial org.wildfly:wildfly-parent (Maven): 21.0.2.Final, 22.0.0.Beta1Red Hat: 7 advisoriesRed Hat: 7 fixed, 10 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—wildfly19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, 21.0.0.Final—No fix listedCNA
—org.wildfly:wildfly-parent (Maven)19.0.0.Final to before 21.0.2.Final21.0.2.FinalPatch availableGHSA-qx3p-9mmp-4v8h
—org.wildfly:wildfly-parent (Maven)22.0.0.Alpha1 to before 22.0.0.Beta122.0.0.Beta1Patch availableGHSA-qx3p-9mmp-4v8h
  • wildfly Vendor— Affected 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, 21.0.0.Final Fixed in — No fix listed CNA
  • org.wildfly:wildfly-parent (Maven) Vendor— Affected 19.0.0.Final to before 21.0.2.Final Fixed in 21.0.2.Final Patch available GHSA-qx3p-9mmp-4v8h
  • org.wildfly:wildfly-parent (Maven) Vendor— Affected 22.0.0.Alpha1 to before 22.0.0.Beta1 Fixed in 22.0.0.Beta1 Patch available GHSA-qx3p-9mmp-4v8h

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly:19.0.0:*:*:*:*:*:*:*19.0.0VulnerableRed Hat
cpe:2.3:a:redhat:wildfly:19.1.0:*:*:*:*:*:*:*19.1.0VulnerableRed Hat
cpe:2.3:a:redhat:wildfly:20.0.0:*:*:*:*:*:*:*20.0.0VulnerableRed Hat
cpe:2.3:a:redhat:wildfly:20.0.1:*:*:*:*:*:*:*20.0.1VulnerableRed Hat
cpe:2.3:a:redhat:wildfly:21.0.0:*:*:*:*:*:*:*21.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:wildfly:19.0.0:*:*:*:*:*:*:* Versions 19.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly:19.1.0:*:*:*:*:*:*:* Versions 19.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly:20.0.0:*:*:*:*:*:*:* Versions 20.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:wildfly:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-qx3p-9mmp-4v8h org.wildfly:wildfly-parent (Maven) Fixed in 21.0.2.Final Advisory →
  • Fix · GHSA-qx3p-9mmp-4v8h org.wildfly:wildfly-parent (Maven) Fixed in 22.0.0.Beta1 Advisory →

Red Hat 7 advisories

  • RHSA-2021:0295 Released 2021-02-08 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.3 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2021:0327 Released 2021-02-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.5 security update
    • Red Hat Single Sign-On 7.4.5
  • RHSA-2021:0317 Released 2021-02-01 · Red Hat rating Moderate
    Red Hat JBoss EAP XP 1.0.4.GA release and security update
    • Red Hat EAP-XP 1.0.4
Show 4 more Red Hat advisories
  • RHSA-2021:0248 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el8eap +47
  • RHSA-2021:0247 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el7eap +47
  • RHSA-2021:0246 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el6eap +47
  • RHSA-2021:0250 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat EAP-XP 1.0.4Fixed RHSA-2021:0317
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0248
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0246
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0247
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0250
Red Hat Single Sign-On 7.4.5Fixed RHSA-2021:0327
Text-Only RHOARFixed RHSA-2021:0295
Not affected: 4 products
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27822
  2. 2026-10-03 Alias added: GHSA-qx3p-9mmp-4v8h

References

Advisory 2

Other 6

  • TI-2018-07554 An issue was discovered in WildFly 10.1.2.Final. CVSS 3.1CRITICAL 9.8
  • TI-2019-11091 A flaw was found when an OpenSSL security provider is used with Wildfly, the… CVSS 3.1CRITICAL 9.1
  • TI-2019-02903 It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in… CVSS 3.1HIGH 8.8
  • TI-2020-08639 Deserialization of untrusted data in [UNKNOWN] wildfly CVSS 3.1HIGH 7.5
  • TI-2020-08617 A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded… CVSS 3.1HIGH 7.5
  • TI-2022-01162 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and… CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences