Medium severity · published May 2, 2024
CVE-2024-4029
Wildfly: no timeout for eap management interface may lead to denial of service (dos)
4.1
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Data Grid 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Process Automation 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4029
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8075
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8076
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8077
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8080
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8823
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8824
More from Red Hat Fuse 7
10.0
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
10.0
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils