CVE-2014-0086

JBoss RichFaces 4.3.4-4.3.5 and 5.x - Denial of Service via Malformed Atmosphere Push Requests

Title source: llm
STIX 2.1

Description

The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.

References (5)

Core 5
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0335.html
Patch x_refsource_confirm
https://issues.jboss.org/browse/RF-13250
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1067268
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57053

Scores

EPSS 0.0146
EPSS Percentile 70.5%

Details

CWE
CWE-20
Status published
Products (5)
org.richfaces/richfaces 4.3.4Maven
redhat/jboss_web_framework_kit 2.5.0
redhat/richfaces 4.3.4
redhat/richfaces 4.3.5
redhat/richfaces 5.0.0 alpha1 (3 CPE variants)
Published Mar 31, 2014
Tracked Since Feb 18, 2026