Skip to content
Fencer Vulns
medium 4.1

CVE-2024-4029 json

Wildfly: no timeout for eap management interface may lead to denial of service (dos)

published 2024-05-02 2 y ago modified 2026-11-07 45 h ago also EUVD-2024-1854 , GHSA-x7g6-rwhc-g7mj

cvss
4.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.

Patch / fix

  • Red Hat Red Hat JBoss Enterprise Application Platform 15.0.39.Final-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.1.3-1.redhat_00001.1.el8eap, 0:1.5.18-1.Final_redhat_00001.1.el8eap, 0:1.10.0-39.Final_redhat_00039.1.el8eap, 0:1.15.4-1.redhat_00003.1.el8eap, 0:2.0.15-1.Final_redhat_00001.1.el8eap, 0:2.7.1-37.redhat_00015.1.el8eap, 0:3.3.24-1.Final_redhat_00001.1.el8eap, 0:4.0.55-1.Final_redhat_00001.1.el8eap, 0:5.4.12-1.Final_redhat_00001.1.el8eap, 0:6.0.23-2.SP1_redhat_00001.1.el8eap, 0:7.4.19-1.GA_redhat_00002.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 0:1.1.3-1.redhat_00001.1.el9eap, 0:1.5.18-1.Final_redhat_00001.1.el9eap, 0:1.10.0-39.Final_redhat_00039.1.el9eap, 0:1.15.4-1.redhat_00003.1.el9eap, 0:2.0.15-1.Final_redhat_00001.1.el9eap, 0:2.7.1-37.redhat_00015.1.el9eap, 0:3.3.24-1.Final_redhat_00001.1.el9eap, 0:4.0.55-1.Final_redhat_00001.1.el9eap, 0:5.4.12-1.Final_redhat_00001.1.el9eap, 0:6.0.23-2.SP1_redhat_00001.1.el9eap, 0:7.4.19-1.GA_redhat_00002.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 0:1.1.3-1.redhat_00001.1.el7eap, 0:1.5.18-1.Final_redhat_00001.1.el7eap, 0:1.10.0-39.Final_redhat_00039.1.el7eap, 0:1.15.4-1.redhat_00003.1.el7eap, 0:2.0.15-1.Final_redhat_00001.1.el7eap, 0:2.7.1-37.redhat_00015.1.el7eap, 0:3.3.24-1.Final_redhat_00001.1.el7eap, 0:4.0.55-1.Final_redhat_00001.1.el7eap, 0:5.4.12-1.Final_redhat_00001.1.el7eap, 0:6.0.23-2.SP1_redhat_00001.1.el7eap, 0:7.4.19-1.GA_redhat_00002.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:0.1.0-2.redhat_00010.1.el8eap, 0:0.8.1-2.redhat_00001.1.el8eap, 0:1.1.3-1.redhat_00001.1.el8eap, 0:1.2.5-2.redhat_00001.1.el8eap, 0:1.8.0-2.redhat_00001.1.el8eap, 0:1.12.284-2.redhat_00002.1.el8eap, 0:1.16.1-2.redhat_00007.1.el8eap, 0:2.0.1-1.redhat_00002.1.el8eap, 0:2.1.0-4.redhat_00001.1.el8eap, 0:2.2.0-2.redhat_00001.1.el8eap, 0:2.15.1-1.redhat_00001.1.el8eap, 0:2.33.0-1.redhat_00015.1.el8eap, 0:3.0.1-1.redhat_00001.1.el8eap, 0:3.2.2-28.redhat_2.1.el8eap, 0:3.14.0-2.redhat_00006.1.el8eap, 0:4.0.5-1.redhat_00001.1.el8eap, 0:6.2.31-1.Final_redhat_00002.1.el8eap, 0:8.0.1-3.Final_redhat_00001.1.el8eap, 0:800.4.0-1.GA_redhat_00001.1.el8eap, 1:2.0.0-2.redhat_00005.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:0.1.0-2.redhat_00010.1.el9eap, 0:0.8.1-2.redhat_00001.1.el9eap, 0:1.1.3-1.redhat_00001.1.el9eap, 0:1.2.5-2.redhat_00001.1.el9eap, 0:1.8.0-2.redhat_00001.1.el9eap, 0:1.12.284-2.redhat_00002.1.el9eap, 0:1.16.1-2.redhat_00007.1.el9eap, 0:2.0.1-1.redhat_00002.1.el9eap, 0:2.1.0-4.redhat_00001.1.el9eap, 0:2.2.0-2.redhat_00001.1.el9eap, 0:2.15.1-1.redhat_00001.1.el9eap, 0:2.33.0-1.redhat_00015.1.el9eap, 0:3.0.1-1.redhat_00001.1.el9eap, 0:3.2.2-28.redhat_2.1.el9eap, 0:3.14.0-2.redhat_00006.1.el9eap, 0:4.0.5-1.redhat_00001.1.el9eap, 0:6.2.31-1.Final_redhat_00002.1.el9eap, 0:8.0.1-3.Final_redhat_00001.1.el9eap, 0:800.4.0-1.GA_redhat_00001.1.el9eap, 1:2.0.0-2.redhat_00005.1.el9eap
  • eap8-hppc jboss enterprise application platform 8.0 0.8.1-2.redhat_00001.1.el8eap
  • eap8-log4j jboss enterprise application platform 8.0 2.22.1-1.redhat_00002.1.el8eap
  • eap8-slf4j jboss enterprise application platform 8.0 2.0.16-1.redhat_00001.1.el8eap
  • eap8-jctools jboss enterprise application platform 8.0 4.0.2-1.redhat_00001.1.el8eap
  • eap8-jgroups jboss enterprise application platform 8.0 5.3.10-1.Final_redhat_00001.1.el8eap
  • eap8-wildfly jboss enterprise application platform 8.0 8.0.4-2.GA_redhat_00005.1.el8eap
  • eap8-narayana jboss enterprise application platform 8.0 6.0.3-1.Final_redhat_00001.1.el8eap
  • eap8-asyncutil jboss enterprise application platform 8.0 0.1.0-2.redhat_00010.1.el8eap

red hat advisories RHSA-2024:8823RHSA-2024:8824RHSA-2024:8077RHSA-2024:8075RHSA-2024:8076

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-4029 updated cvss 4.1

wildfly: No timeout for EAP management interface may lead to Denial of Service (DoS)

  • Red Hat Fuse 7 wildfly-domain-http Red Hat JBoss Data Grid 7 wildfly-domain-http Red Hat Process Automation 7 wildfly-domain-http
    affected: workaround, no fix planned “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.”
  • Red Hat Single Sign-On 7 wildfly-domain-http
    affected: workaround, no fix available “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.”
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jsoup 1.15.4-1.redhat_00003.1.el7eap, eap7-xalan-j2 2.7.1-37.redhat_00015.1.el7eap, eap7-wildfly 7.4.19-1.GA_redhat_00002.1.el7eap, eap7-jboss-cert-helper 1.1.3-1.redhat_00001.1.el7eap, eap7-hal-console 3.3.24-1.Final_redhat_00001.1.el7eap, eap7-ironjacamar 1.5.18-1.Final_redhat_00001.1.el7eap, +21 more
    fixed: vendor fix “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.” RHSA-2024:8075
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jsoup 1.15.4-1.redhat_00003.1.el8eap, eap7-xalan-j2 2.7.1-37.redhat_00015.1.el8eap, eap7-wildfly 7.4.19-1.GA_redhat_00002.1.el8eap, eap7-jboss-cert-helper 1.1.3-1.redhat_00001.1.el8eap, eap7-hal-console 3.3.24-1.Final_redhat_00001.1.el8eap, eap7-ironjacamar 1.5.18-1.Final_redhat_00001.1.el8eap, +22 more
    fixed: vendor fix “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.” RHSA-2024:8076
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jsoup 1.15.4-1.redhat_00003.1.el9eap, eap7-xalan-j2 2.7.1-37.redhat_00015.1.el9eap, eap7-wildfly 7.4.19-1.GA_redhat_00002.1.el9eap, eap7-jboss-cert-helper 1.1.3-1.redhat_00001.1.el9eap, eap7-hal-console 3.3.24-1.Final_redhat_00001.1.el9eap, eap7-ironjacamar 1.5.18-1.Final_redhat_00001.1.el9eap, +22 more
    fixed: vendor fix “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.” RHSA-2024:8077
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-hppc 0.8.1-2.redhat_00001.1.el8eap, eap8-log4j 2.22.1-1.redhat_00002.1.el8eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el8eap, eap8-jctools 4.0.2-1.redhat_00001.1.el8eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el8eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el8eap, +74 more
    fixed: vendor fix “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.” RHSA-2024:8823
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-hppc 0.8.1-2.redhat_00001.1.el9eap, eap8-log4j 2.22.1-1.redhat_00002.1.el9eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el9eap, eap8-jctools 4.0.2-1.redhat_00001.1.el9eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el9eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el9eap, +74 more
    fixed: vendor fix “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.” RHSA-2024:8824
  • Red Hat JBoss Enterprise Application Platform wildfly-domain-http-interface 15.0.39.Final-redhat-00001
    fixed: vendor fix “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.” RHSA-2024:8080
show 2 more
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix “Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.” RHSA-2024:8826
  • Red Hat Build of Keycloak wildfly-domain-http Red Hat Data Grid 8 wildfly-domain-http Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1561 more Red Hat JBoss Enterprise Application Platform Expansion Pack wildfly-domain-http
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.wildfly:wildfly-domain-http
<=24.0.0.Final
 no fix listed

Affected products

  • Red Hat Red Hat JBoss Enterprise Application Platform
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.