CVE-2024-8447: Narayana: deadlock via multiple join requests sent to lra coordinator

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-02 · updated 2026-09-07
Weakness: CWE-833

Description

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.

Affected products

Red Hat JBoss Data Grid 7: all versions
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8: all versions — fixed in 0:2.0.16-2.redhat_00003.1.el8eap, 0:4.1.119-1.Final_redhat_00002.1.el8eap, 0:8.0.6-15.GA_redhat_00009.1.el8eap, 0:800.6.1-1.GA_redhat_00001.1.el8eap
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9: all versions — fixed in 0:2.0.16-2.redhat_00003.1.el9eap, 0:4.1.119-1.Final_redhat_00002.1.el9eap, 0:8.0.6-15.GA_redhat_00009.1.el9eap, 0:800.6.1-1.GA_redhat_00001.1.el9eap
Red Hat JBoss Enterprise Application Platform Expansion Pack: all versions

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:2.0.16-2.redhat_00003.1.el8eap, 0:4.1.119-1.Final_redhat_00002.1.el8eap, 0:8.0.6-15.GA_redhat_00009.1.el8eap, 0:800.6.1-1.GA_redhat_00001.1.el8eap; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:2.0.16-2.redhat_00003.1.el9eap, 0:4.1.119-1.Final_redhat_00002.1.el9eap, 0:8.0.6-15.GA_redhat_00009.1.el9eap, 0:800.6.1-1.GA_redhat_00001.1.el9eap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-8447 or the next vulnerability affects your stack