CVE-2020-14340

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-02 · updated 2026-06-17
Weakness: CWE-400

Description

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.

Affected products

Oracle Communications Cloud Native Core Console: 1.9.0
Oracle Communications Cloud Native Core Network Repository Function: 1.14.0
Oracle Communications Cloud Native Core Policy: 1.14.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy: 1.15.0
Oracle Communications Cloud Native Core Service Communication Proxy: 1.14.0
Oracle Communications Cloud Native Core Unified Data Repository: 1.14.0
Red Hat JBoss BRMS: 5, 6
RedHat Jboss Data Grid: 6.0.0, 7.0.0
RedHat Jboss Data Virtualization: 6.0.0
Red Hat JBoss EAP: 5.0.0, 6.0.0
RedHat Jboss Fuse: 6.0.0, 7.0.0
Red Hat JBoss: 3.0
Red Hat JBoss SOA Platform: 5
RedHat Xnio: from 3.6.1 before 3.7.9; from 3.8.0 before 3.8.2; 3.6.0-beta1, 3.6.0-beta2 — fixed in 3.7.9, 3.8.2

How to fix

Upgrade to a fixed version: RedHat Xnio 3.7.9, 3.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-14340 or the next vulnerability affects your stack