CVE-2019-19343

HIGH

JBoss Remoting < 5.0.14 and Undertow < 2.0.25 - Denial of Service via HttpOpenListener Memory Leak

Title source: llm
STIX 2.1

Description

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1 are believed to be vulnerable.

References (3)

Core 3
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1780445
Permissions Required, Vendor Advisory x_refsource_misc
https://issues.redhat.com/browse/JBEAP-16695
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220211-0002/

Scores

CVSS v3 7.5
EPSS 0.0051
EPSS Percentile 66.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-400 CWE-404
Status published
Products (6)
netapp/active_iq_unified_manager (3 CPE variants)
redhat/jboss-remoting 5.0.14
redhat/jboss-remoting < 5.0.14
redhat/jboss_enterprise_application_platform < 7.2.4
redhat/undertow 2.0.25
redhat/undertow < 2.0.25
Published Mar 23, 2021
Tracked Since Feb 18, 2026