Skip to content
Fencer Vulns
high 7.5

CVE-2022-0853 json

A flaw was found in JBoss-client.

published 2022-03-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-15896

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.

Patch / fix

  • eap7-netty jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.5-3.GA_redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.17-2.SP4_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap
  • eap7-xerces-j2 jboss enterprise application platform 7.4 2.12.0-3.SP04_redhat_00001.1.el7eap
  • eap7-h2database jboss enterprise application platform 7.4 1.4.197-2.redhat_00004.1.el7eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.12-1.Final_redhat_00001.1.el7eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.72-4.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2022:4918RHSA-2022:4919RHSA-2022:7411RHSA-2022:7409RHSA-2022:7410

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0853 updated cvss 6.5

jboss-client: memory leakage in remote client transaction

  • Red Hat Decision Manager 7 jboss-client jboss-client
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Enterprise Application Platform 6 jboss-client jboss-client
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack jboss-client jboss-client Red Hat JBoss Fuse 6 jboss-client jboss-client
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Operations Network 3 jboss-client jboss-client Red Hat OpenShift Container Platform 3.11 jboss-client
    affected: no fix planned “Out of support scope”
  • Red Hat Process Automation 7 jboss-client jboss-client
    affected: no fix available “Fix deferred”
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly-http-client 1.1.11-1.SP1_redhat_00001.1.el7eap, eap7-wildfly-http-ejb-client 1.1.11-1.SP1_redhat_00001.1.el7eap, eap7-wildfly-http-client-common 1.1.11-1.SP1_redhat_00001.1.el7eap, eap7-wildfly-http-naming-client 1.1.11-1.SP1_redhat_00001.1.el7eap, eap7-wildfly-http-transaction-client 1.1.11-1.SP1_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2022:4918
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly-http-client 1.1.11-1.SP1_redhat_00001.1.el8eap, eap7-wildfly-http-ejb-client 1.1.11-1.SP1_redhat_00001.1.el8eap, eap7-wildfly-http-client-common 1.1.11-1.SP1_redhat_00001.1.el8eap, eap7-wildfly-http-naming-client 1.1.11-1.SP1_redhat_00001.1.el8eap, eap7-wildfly-http-transaction-client 1.1.11-1.SP1_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2022:4919
  • Red Hat JBoss Enterprise Application Platform wildfly-transaction-client 1.1.15.Final-redhat-00001
    fixed: vendor fix RHSA-2022:4922
show 5 more
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2022:7409
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.3-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2022:7410
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7 1-5.el9sso, rh-sso7-runtime 1-5.el9sso, rh-sso7-javapackages-tools 6.0.0-7.el9sso, rh-sso7-python3-javapackages 6.0.0-7.el9sso, rh-sso7-javapackages-filesystem 6.0.0-7.el9sso, rh-sso7-keycloak 18.0.3-1.redhat_00001.1.el9sso, +1 more
    fixed: vendor fix RHSA-2022:7411
  • Red Hat Single Sign-On 7.6.1
    fixed: vendor fix RHSA-2022:7417
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j 2.17.1-2.redhat_00002.1.el7eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el7eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el7eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el7eap, eap7-h2database 1.4.197-2.redhat_00004.1.el7eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el7eap, +80 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j 2.17.1-2.redhat_00002.1.el8eap, eap7-jberet 1.3.9-1.SP1_redhat_00001.1.el8eap, eap7-snakeyaml 1.29.0-1.redhat_00001.2.el8eap, eap7-wildfly 7.4.5-3.GA_redhat_00001.1.el8eap, eap7-h2database 1.4.197-2.redhat_00004.1.el8eap, eap7-netty 4.1.72-4.Final_redhat_00001.1.el8eap, +78 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1482 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.45% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/ByteHackr/CVE-2022-0853 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • n/a jboss-client

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.