CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2020-25644
High (7.5). EPSS 2.4% chance of exploitation in the next 30 days. Fixed in org.wildfly.openssl:wildfly-openssl-natives-parent 1.1.3.Final.
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
Severity
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-401
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:oncommand_insight
- netapp:oncommand_workflow_automation
- netapp:service_level_manager
- redhat:data_grid
- redhat:jboss_data_grid
- redhat:jboss_enterprise_application_platform
- redhat:jboss_fuse
- redhat:openshift_application_runtimes
- redhat:single_sign-on
- redhat:wildfly_openssl
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hxj4-885f-grgp | Maven | org.wildfly.openssl:wildfly-openssl-natives-parent | <1.1.3.Final | 1.1.3.Final |