What’s Vulnerable › Vulnerabilities

CVE-2020-14297

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-24 · updated 2026-06-17
• Weakness: CWE-400

Description

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.

Affected products

• RedHat Amq: 2.0
• RedHat Jboss-Ejb-Client: from 1.0.0 before 4.0.34 — fixed in 4.0.34
• RedHat Jboss Enterprise Application Platform Continuous Delivery: all versions
• RedHat Jboss Fuse: 6.0.0
• RedHat Openshift Application Runtimes: all versions
• Red Hat Single Sign-On: 7.0

How to fix

Upgrade to a fixed version: RedHat Jboss-Ejb-Client 4.0.34. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297

Get alerted when CVE-2020-14297 or the next vulnerability affects your stack