Skip to content
Fencer Vulns
high 7.5

CVE-2020-25644 json

Wildfly-OpenSSL memory leak flaw

published 2020-10-06 6 y ago modified 2026-06-17 4 mo ago also GHSA-hxj4-885f-grgp , EUVD-2022-4242

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

Patch / fix

  • maven org.wildfly.openssl:wildfly-openssl-natives-parent 1.1.3.Final
  • redhat wildfly_openssl 1.1.3
  • eap7-jasypt jboss enterprise application platform 7.3 1.9.3-1.redhat_00002.1.el8eap
  • eap7-fge-btf jboss enterprise application platform 7.3 1.2.0-1.redhat_00007.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.3 7.3.4-3.GA_redhat_00003.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.3 2.0.32-1.SP1_redhat_00001.1.el8eap
  • eap7-hal-console jboss enterprise application platform 7.3 3.2.11-1.Final_redhat_00001.1.el8eap
  • eap7-jackson-core jboss enterprise application platform 7.3 2.10.4-1.redhat_00002.1.el8eap
  • eap7-fge-msg-simple jboss enterprise application platform 7.3 1.1.0-1.redhat_00007.1.el8eap
  • eap7-jboss-remoting jboss enterprise application platform 7.3 5.0.19-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2025:9582RHSA-2020:5342RHSA-2020:5341RHSA-2020:5340RHSA-2020:4922RHSA-2020:4256

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-25644 updated cvss 7.5

wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL

  • Red Hat OpenShift Application Runtimes wildfly-openssl wildfly-openssl
    affected: workaround, no fix available “There is currently no known mitigation for this issue.”
  • Red Hat EAP 7.3.3
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:4923
  • Red Hat Data Grid 7.3.8
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:5410
  • Red Hat Data Grid 8.1.1
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2021:0433
  • Red Hat Fuse 7.9
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2021:3140
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-jasypt 1.9.3-1.redhat_00002.1.el8eap, eap7-fge-btf 1.2.0-1.redhat_00007.1.el8eap, eap7-wildfly 7.3.4-3.GA_redhat_00003.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00002.1.el8eap, eap7-undertow 2.0.32-1.SP1_redhat_00001.1.el8eap, eap7-fge-msg-simple 1.1.0-1.redhat_00007.1.el8eap, +63 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:4256
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-jasypt 1.9.3-1.redhat_00002.1.el6eap, eap7-fge-btf 1.2.0-1.redhat_00007.1.el6eap, eap7-wildfly 7.3.4-3.GA_redhat_00003.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00002.1.el6eap, eap7-undertow 2.0.32-1.SP1_redhat_00001.1.el6eap, eap7-fge-msg-simple 1.1.0-1.redhat_00007.1.el6eap, +63 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:5340
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-jasypt 1.9.3-1.redhat_00002.1.el7eap, eap7-fge-btf 1.2.0-1.redhat_00007.1.el7eap, eap7-wildfly 7.3.4-3.GA_redhat_00003.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00002.1.el7eap, eap7-undertow 2.0.32-1.SP1_redhat_00001.1.el7eap, eap7-fge-msg-simple 1.1.0-1.redhat_00007.1.el7eap, +65 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:4256
show 4 more
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:4257
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.11-4.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-2.Final_redhat_00003.1.ep7.el7, eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7, eap7-glassfish-el 3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-3.Final_redhat_00004.1.ep7.el7, eap7-netty-all 4.1.63-2.Final_redhat_00003.1.ep7.el7, +19 more
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2025:9582
  • Red Hat Single Sign-On 7.4.3 one-off
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:4978
  • Red Hat Decision Manager 7 wildfly-openssl wildfly-openssl Red Hat Process Automation 7 wildfly-openssl wildfly-openssl
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.37% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.wildfly.openssl:wildfly-openssl-natives-parent
<1.1.3.Final
1.1.3.Final

Affected products

  • n/a wildfly-openssl

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.