CVE-2024-4029: Wildfly: no timeout for eap management interface may lead to denial of service (dos)

Severity: medium (CVSS 4.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-02 · updated 2026-09-24
Weakness: CWE-770

Description

A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.

Affected products

Red Hat JBoss Enterprise Application Platform: all versions — fixed in 15.0.39.Final-redhat-00001
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8: all versions — fixed in 0:1.1.3-1.redhat_00001.1.el8eap, 0:1.10.0-39.Final_redhat_00039.1.el8eap, 0:1.15.4-1.redhat_00003.1.el8eap, 0:1.5.18-1.Final_redhat_00001.1.el8eap, 0:2.0.15-1.Final_redhat_00001.1.el8eap, 0:2.7.1-37.redhat_00015.1.el8eap
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9: all versions — fixed in 0:1.1.3-1.redhat_00001.1.el9eap, 0:1.10.0-39.Final_redhat_00039.1.el9eap, 0:1.15.4-1.redhat_00003.1.el9eap, 0:1.5.18-1.Final_redhat_00001.1.el9eap, 0:2.0.15-1.Final_redhat_00001.1.el9eap, 0:2.7.1-37.redhat_00015.1.el9eap
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7: all versions — fixed in 0:1.1.3-1.redhat_00001.1.el7eap, 0:1.10.0-39.Final_redhat_00039.1.el7eap, 0:1.15.4-1.redhat_00003.1.el7eap, 0:1.5.18-1.Final_redhat_00001.1.el7eap, 0:2.0.15-1.Final_redhat_00001.1.el7eap, 0:2.7.1-37.redhat_00015.1.el7eap
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: all versions — fixed in 0:0.1.0-2.redhat_00010.1.el8eap, 0:0.8.1-2.redhat_00001.1.el8eap, 0:1.1.3-1.redhat_00001.1.el8eap, 0:1.12.284-2.redhat_00002.1.el8eap, 0:1.16.1-2.redhat_00007.1.el8eap, 0:1.2.5-2.redhat_00001.1.el8eap
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: all versions — fixed in 0:0.1.0-2.redhat_00010.1.el9eap, 0:0.8.1-2.redhat_00001.1.el9eap, 0:1.1.3-1.redhat_00001.1.el9eap, 0:1.12.284-2.redhat_00002.1.el9eap, 0:1.16.1-2.redhat_00007.1.el9eap, 0:1.2.5-2.redhat_00001.1.el9eap
Red Hat Single Sign-On 7: all versions

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 15.0.39.Final-redhat-00001; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:1.1.3-1.redhat_00001.1.el8eap, 0:1.10.0-39.Final_redhat_00039.1.el8eap, 0:1.15.4-1.redhat_00003.1.el8eap, 0:1.5.18-1.Final_redhat_00001.1.el8eap; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 0:1.1.3-1.redhat_00001.1.el9eap, 0:1.10.0-39.Final_redhat_00039.1.el9eap, 0:1.15.4-1.redhat_00003.1.el9eap, 0:1.5.18-1.Final_redhat_00001.1.el9eap; Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 0:1.1.3-1.redhat_00001.1.el7eap, 0:1.10.0-39.Final_redhat_00039.1.el7eap, 0:1.15.4-1.redhat_00003.1.el7eap, 0:1.5.18-1.Final_redhat_00001.1.el7eap; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:0.1.0-2.redhat_00010.1.el8eap, 0:0.8.1-2.redhat_00001.1.el8eap, 0:1.1.3-1.redhat_00001.1.el8eap, 0:1.12.284-2.redhat_00002.1.el8eap; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:0.1.0-2.redhat_00010.1.el9eap, 0:0.8.1-2.redhat_00001.1.el9eap, 0:1.1.3-1.redhat_00001.1.el9eap, 0:1.12.284-2.redhat_00002.1.el9eap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-4029 or the next vulnerability affects your stack