CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2020-35510
Medium (5.9) in redhat jboss-remoting. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in org.jboss.remoting:jboss-remoting 5.0.20.Final.
A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:jboss-remoting
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p6j8-hgv5-m35g | Maven | org.jboss.remoting:jboss-remoting | <5.0.20.Final | 5.0.20.Final |