Skip to content
Fencer Vulns
high 7.5

CVE-2020-7226 json

Denial of Service in Cryptacular

published 2020-01-24 6 y ago modified 2026-06-17 4 mo ago also GHSA-x64g-4xx9-fh6x , EUVD-2020-0522

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.3%
EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.

Patch / fix

  • maven org.cryptacular:cryptacular 1.1.4, 1.2.4
  • vt cryptacular 1.1.4, 1.2.4
  • eap7-txw2 jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
  • eap7-xsom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
  • eap7-rngom jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap
  • eap7-wss4j jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 2.2.5-1.redhat_00001.1.el7eap
  • eap7-jandex jboss enterprise application platform 7.3 2.1.2-1.Final_redhat_00001.1.el7eap
  • eap7-jasypt jboss enterprise application platform 7.3, jboss enterprise application platform 7.2 1.9.3-1.redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.3 7.3.1-5.GA_redhat_00003.1.el7eap
  • eap7-jaxb-jxc jboss enterprise application platform 7.3 2.3.3-4.b02_redhat_00001.1.el7eap

red hat advisories RHSA-2020:2512RHSA-2020:2511RHSA-2020:2513RHSA-2020:2060RHSA-2020:2059RHSA-2020:2058

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-7226 updated cvss 7.5

cryptacular: excessive memory allocation during a decode operation

  • Red Hat JBoss Fuse 6 cryptacular
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes cryptacular
    affected: no fix available
  • Red Hat Fuse 7.8.0
    fixed: vendor fix RHSA-2020:5568
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2020:2061
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el6eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el6eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el6eap, +152 more
    fixed: vendor fix RHSA-2020:2058
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el7eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el7eap, +154 more
    fixed: vendor fix RHSA-2020:2059
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-wildfly 7.2.8-3.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.2.12-1.redhat_00001.1.el8eap, eap7-cryptacular 1.2.4-1.redhat_00001.1.el8eap, +152 more
    fixed: vendor fix RHSA-2020:2060
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-wss4j 2.2.5-1.redhat_00001.1.el8eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el8eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el8eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el8eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el8eap, +194 more
    fixed: vendor fix RHSA-2020:2513
show 5 more
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el6eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el6eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el6eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el6eap, +194 more
    fixed: vendor fix RHSA-2020:2511
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-wss4j 2.2.5-1.redhat_00001.1.el7eap, eap7-jasypt 1.9.3-1.redhat_00001.1.el7eap, eap7-opensaml 3.3.1-1.redhat_00002.1.el7eap, eap7-txw2 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-xsom 2.3.3-4.b02_redhat_00001.1.el7eap, eap7-rngom 2.3.3-4.b02_redhat_00001.1.el7eap, +196 more
    fixed: vendor fix RHSA-2020:2512
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2020:2515
  • Red Hat Single Sign On 7.3.8
    fixed: vendor fix RHSA-2020:2112
  • Red Hat Decision Manager 7 cryptacular Red Hat Process Automation 7 cryptacular
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.33% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.java#L153 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/vt-middleware/cryptacular/issues/52 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.cryptacular:cryptacular
<1.1.4
>=1.2.0, <1.2.4
1.1.4
1.2.4

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.