Skip to content
Fencer Vulns
medium 5.9

CVE-2024-8447 json

Narayana: deadlock via multiple join requests sent to lra coordinator

published 2025-01-02 22 mo ago modified 2026-09-07 2 mo ago also GHSA-qq9f-q439-2574 , EUVD-2025-0041

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.

Patch / fix

  • maven org.jboss.narayana.rts:lra-coordinator-jar 7.1.0.Final
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:2.0.16-2.redhat_00003.1.el8eap, 0:4.1.119-1.Final_redhat_00002.1.el8eap, 0:8.0.6-15.GA_redhat_00009.1.el8eap, 0:800.6.1-1.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:2.0.16-2.redhat_00003.1.el9eap, 0:4.1.119-1.Final_redhat_00002.1.el9eap, 0:8.0.6-15.GA_redhat_00009.1.el9eap, 0:800.6.1-1.GA_redhat_00001.1.el9eap
  • eap8-netty jboss enterprise application platform 8.0 4.1.119-1.Final_redhat_00002.1.el8eap
  • eap8-netty jboss enterprise application platform 8.0 4.1.119-1.Final_redhat_00002.1.el9eap
  • eap8-slf4j jboss enterprise application platform 8.0 2.0.16-2.redhat_00003.1.el8eap
  • eap8-slf4j jboss enterprise application platform 8.0 2.0.16-2.redhat_00003.1.el9eap
  • eap8-wildfly jboss enterprise application platform 8.0 8.0.6-15.GA_redhat_00009.1.el8eap
  • eap8-wildfly jboss enterprise application platform 8.0 8.0.6-15.GA_redhat_00009.1.el9eap
  • eap8-slf4j-api jboss enterprise application platform 8.0 2.0.16-2.redhat_00003.1.el8eap
  • eap8-slf4j-api jboss enterprise application platform 8.0 2.0.16-2.redhat_00003.1.el9eap

red hat advisories RHSA-2025:3357

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-8447 updated cvss 5.9

narayana: deadlock via multiple join requests sent to LRA Coordinator

  • Red Hat JBoss Data Grid 7 org.jboss.narayana-narayana-all org.jboss.narayana-narayana-all
    affected: no fix available
  • Red Hat JBoss Enterprise Application Platform 7 org.jboss.narayana-narayana-all org.jboss.narayana-narayana-all
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack org.jboss.narayana-narayana-all org.jboss.narayana-narayana-all
    affected: no fix available
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-slf4j 2.0.16-2.redhat_00003.1.el8eap, eap8-slf4j-api 2.0.16-2.redhat_00003.1.el8eap, eap8-wildfly 8.0.6-15.GA_redhat_00009.1.el8eap, eap8-netty 4.1.119-1.Final_redhat_00002.1.el8eap, eap8-netty-codec 4.1.119-1.Final_redhat_00002.1.el8eap, eap8-wildfly-modules 8.0.6-15.GA_redhat_00009.1.el8eap, +18 more Red Hat JBoss EAP 8.0 for RHEL 9 eap8-slf4j 2.0.16-2.redhat_00003.1.el9eap, eap8-slf4j-api 2.0.16-2.redhat_00003.1.el9eap, eap8-wildfly 8.0.6-15.GA_redhat_00009.1.el9eap, eap8-netty 4.1.119-1.Final_redhat_00002.1.el9eap, eap8-netty-codec 4.1.119-1.Final_redhat_00002.1.el9eap, eap8-wildfly-modules 8.0.6-15.GA_redhat_00009.1.el9eap, +18 more
    fixed: vendor fix RHSA-2025:3357
  • Red Hat JBoss EAP XP 5.0 Update 2.0
    fixed: vendor fix RHSA-2025:7620
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix RHSA-2025:3358

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
22 mo ago

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.jboss.narayana.rts:lra-coordinator-jar
<7.1.0.Final
7.1.0.Final

Affected products

  • Red Hat Red Hat JBoss EAP XP 5.0 Update 2.0
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.