CVE-2020-35510

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-02 · updated 2026-06-17
Weakness: CWE-400

Description

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected products

jboss-remoting: before 5.0.20; 5.0.20 — fixed in 5.0.20

How to fix

Upgrade to a fixed version: jboss-remoting 5.0.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-35510 or the next vulnerability affects your stack