CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2023-1108

CVE-2023-1108 affects Undertow within Red Hat JBoss EAP 7.3.x (SSLConduit) where an infinite loop on close can cause DoS. Connected RHSA-2025-9583 confirms the issue and indicates a fix in the eap-7.3.z line (Patched Undertow). Remediation is to upgrade to the patched EAP 7.3.x release (eap-7.3.z...

CVE-2022-41862

CVE-2022-41862 affects PostgreSQL libpq/client memory disclosure when connecting with Kerberos to a modified server. Connected documents confirm impact across multiple package tracks (libpq for AL2/Linux distros and PostgreSQL server/client suites for various versions, including 12.x–15.x), with ...

CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2024-7885

CVE-2024-7885 affects Undertow's ProxyProtocolReadListener, where parseProxyProtocolV1 reuses a single StringBuilder across multiple requests, potentially leaking data between requests on the same HTTP connection and, in multi-request environments, exposing previous values. The connected Red Hat ...

CVE-2022-4245

CVE-2022-4245 concerns a flaw in codehaus-plexus where, in XmlWriterUtil, the method writeComment fails to sanitize a --> sequence. This allows text in a command string to be interpreted as XML, enabling XML injection. The available connected documents consistently describe this vulnerability...

CVE-2021-3690

CVE-2021-3690 affects Undertow: a buffer leak on the incoming WebSocket PONG message can cause memory exhaustion leading to DoS. The vulnerability impacts Undertow-based components (WebSocket handling). A security update/patch for Undertow is available per OSV/OESA entries; exploit details are no...

CVE-2022-0084

CVE-2022-0084 affects XNIO: the notifyReadClosed path logs to the opposite end, enabling an attacker to send malformed requests that may cause log contention or disk space exhaustion. Connected docs confirm this root cause and cite IBM/Red Hat advisories linking the CVE to XNIO, with remediation ...

CVE-2021-3536

CVE-2021-3536 concerns WildFly/JBoss EAP domain-mode admin console vulnerability allowing XSS via the name field when creating roles, affecting Confidentiality and Integrity. Affected software is WildFly (prior to 23.0.2.Final). The issue arises in the domain mode role-creation flow and can be tr...

CVE-2022-2053

CVE-2022-2053 affects Undertow’s AJP handling: when a POST through AJP exceeds maxEntitySize, AjpServerRequestConduit closes the connection without a response, potentially causing front-end proxies to mark the backend as in error state andCausing DoS via service interruptions. The Nessus NASL ent...

CVE-2022-2764

CVE-2022-2764 concerns Undertow. A DoS can occur because the Undertow server waits for LAST_CHUNK forever during EJB invocations, impacting availability (per CVSS vector: Network, Low access, High impact to availability). Public details in the provided documents specify the vulnerability as a DoS...

CVE-2021-20218

The CVE refers to fabric8 kubernetes-client vulnerability affecting version 4.2.0 and later, where a malicious pod/container can abuse the client’s copy command to extract files outside the working path, impacting integrity and availability. Fixed in kubernetes-client releases 4.13.2, 5.0.2, 4.11...

CVE-2023-4853

CVE-2023-4853 affects Quarkus, where HTTP security policy sanitization fails for certain character permutations in requests. The root cause is improper sanitization, allowing bypass of the security policy and potentially granting unauthorized access to endpoints and causing denial of service. The...

CVE-2021-3642

CVE-2021-3642 describes a timing-attack vulnerability in Wildfly Elytron’s ScramServer, affecting versions prior to 1.10.14.Final, 1.15.5.Final, and 1.16.1.Final. The highest impact is confidentiality; no exploitation details are provided in the documents. Connected advisories (e.g., Red Hat RHSA...

CVE-2022-4492

CVE-2022-4492 is linked to Undertow: the undertow client does not verify the server identity presented by the server certificate in HTTPS connections, a TLS-level check that should be performed by default. This can enable weaknesses in TLS client verification and potential MITM scenarios. Connect...

CVE-2021-4178

CVE-2021-4178 affects the Fabric8 Kubernetes client (versions 5.0.0-beta-1 and newer) due to unsafe YAML parsing in unmarshalYaml, enabling local, privileged code execution via a crafted YAML payload. The issue is confirmed across multiple sources (NVD/NVD-derived entry and Red Hat/Jenkins adviso...

CVE-2022-1259

CVE-2022-1259 is an Undertow-related denial-of-service issue. The root cause is an incomplete fix for CVE-2021-3629, causing potential DoS from HTTP/2 flow-control handling. Connected documents (Nessus plugin references and IBM/Red Hat advisories) confirm this in context of Undertow and note that...

CVE-2022-4244

CVE-2022-4244 covers a directory traversal flaw in codehaus-codehaus (Plexus-Utils). The vulnerability arises from improper handling of path traversal sequences (../ or absolute paths) that could allow access to arbitrary files on the filesystem. Affected products include IBM Cognos Controller (1...

CVE-2022-1278

Summary: CVE-2022-1278 affects WildFly and relates to information disclosure via the trace payload, allowing an attacker to view deployment names, endpoints, and other data contained in traces. What is affected: WildFly stack (as referenced across CVE listings and Red Hat advisories) with exposur...

CVE-2020-14326

CVE-2020-14326 affects RESTEasy: RootNode caching of routes can trigger hash flooding, causing slower requests and higher CPU usage leading to DoS. The description confirms the vulnerability and impact but does not specify affected versions, vulnerable component details beyond RootNode routing ca...