CVE-2023-5685: Red Hat Xnio: stackoverflowexception when the chain of notifier states becomes problematically big
This Red Hat advisory covers CVE-2023-5685 in Red Hat build of Apache Camel 4.4.0 for Spring Boot, Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 and Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7.
- CVE-2023-5685
Key facts
- Vendor rating
- High, CVSS 7.5
- CISA KEV
- Not listed (catalogue checked )
- Fixed in
- xnio, org.jboss.xnio/xnio-nio:3.8.11.SP1-redhat-00001, eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7 and 30 more below
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).
Red Hat rates this vulnerability as an Important impact as the uncontrolled resource consumption may lead to Denial of Service (DoS). This might be intentioned by an attacker who is looking to jeopardize an environment.
Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-400.
Affected Red Hat products: Red Hat build of Apache Camel 4.4.0 for Spring Boot; Red Hat JBoss Enterprise Application Platform; Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9; Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7; Red Hat build of Apache Camel - HawtIO 4; Red Hat Integration Camel K 1; Red Hat JBoss Data Grid 7; Red Hat JBoss Fuse Service Works 6; Red Hat Process Automation 7.
Text from the source record.
How to fix CVE-2023-5685
Upgrade to a fixed release named by Red Hat:
- xnio
- org.jboss.xnio/xnio-nio:3.8.11.SP1-redhat-00001
- eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7
- eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7
- eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7
- eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7
- eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7
- eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7
- eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7
- eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7
- eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7
- eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap
- eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap
- eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap
- eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap
- eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap
- eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap
- eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap
- eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap
- eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap
- eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap
- eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap
- eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap
- eap7-jboss-xnio-base-0:3.8.11-1.SP1_redhat_00001.1.el8eap
- eap7-jboss-xnio-base-0:3.8.11-1.SP1_redhat_00001.1.el9eap
and 8 more in the Red Hat advisory.
Vendor guidance
- There is currently no mitigation available for this vulnerability. Please keep the packages up-to-date as the updates become available.
More Red Hat Linux advisories
CVE-2026-123158Nov 5, 2026Password authentication bypass via password hash misinterpretationCVE-2026-119977Oct 31, 2026Arbitrary code execution via predictable upgrade staging pathsCVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli DecoderCVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-freeCVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCECVE-2026-97229Oct 13, 2026integer overflow issue in CI/CD regular expression compiler
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
