Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2024-4029

Wildfly: no timeout for eap management interface may lead to denial of service (dos)

CVE-2024-4029: Wildfly: no timeout for eap management interface may lead to denial of service (dos). Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2024-4029 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
CVSS base score
4.1 (Red Hat)
CVSS vector
  • CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H (Red Hat)
Weakness
CWE-770
Fixed releases
  • Red Hat: org.wildfly.core/wildfly-domain-http-interface:15.0.39.Final-redhat-00001, eap7-hal-console-0:3.3.24-1.Final_redhat_00001.1.el8eap, eap7-hibernate-validator-0:6.0.23-2.SP1_redhat_00001.1.el8eap, eap7-insights-java-client-0:1.1.3-1.redhat_00001.1.el8eap, eap7-ironjacamar-0:1.5.18-1.Final_redhat_00001.1.el8eap, eap7-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el8eap and 41 more in the advisory
Vendor advisories
1 from Red Hat
VulniPulse record
Published

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2024-4029; bulletin-wide values are not repeated here.

Is CVE-2024-4029 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2024-4029 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2024-4029?

Upgrade to a fixed release named by the vendor:

  • Red Hat: org.wildfly.core/wildfly-domain-http-interface:15.0.39.Final-redhat-00001, eap7-hal-console-0:3.3.24-1.Final_redhat_00001.1.el8eap, eap7-hibernate-validator-0:6.0.23-2.SP1_redhat_00001.1.el8eap, eap7-insights-java-client-0:1.1.3-1.redhat_00001.1.el8eap, eap7-ironjacamar-0:1.5.18-1.Final_redhat_00001.1.el8eap, eap7-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el8eap
  • Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available. (Red Hat)

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium4.1

    Medium [CVE-2024-4029] Wildfly: no timeout for eap management interface may lead to denial of service (dos)

    CVE-2024-4029Source published Source updated

    A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections. Red Hat rates this as a Low impact since this requires high privileges to jeopardize the system. The management interface is normally internal/local only and not exposed externally. Red Hat severity: Low — CVSS 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9; Red Hat JBoss Enterprise…

    Affected products in this advisory
    • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
    • Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
    • Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

    5 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • org.wildfly.core/wildfly-domain-http-interface:15.0.39.Final-redhat-00001
    • eap7-hal-console-0:3.3.24-1.Final_redhat_00001.1.el8eap
    • eap7-hibernate-validator-0:6.0.23-2.SP1_redhat_00001.1.el8eap
    • eap7-insights-java-client-0:1.1.3-1.redhat_00001.1.el8eap

    43 more entries in the full advisory.

    Mitigation guidance
    • Currently there is no available mitigation for this vulnerability. Please make sure to perform updates as they become available.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features