CVE-2024-8447: Narayana deadlock via multiple join requests sent to LRA Coordinator
(updated )
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
References
- access.redhat.com/errata/RHSA-2025:3357
- access.redhat.com/errata/RHSA-2025:3358
- access.redhat.com/errata/RHSA-2025:7620
- access.redhat.com/security/cve/CVE-2024-8447
- bugzilla.redhat.com/show_bug.cgi?id=2335206
- github.com/advisories/GHSA-qq9f-q439-2574
- github.com/jbosstm/narayana
- github.com/jbosstm/narayana/commit/eb778412de230afc4687a2df43641280494156c5
- github.com/jbosstm/narayana/pull/2293
- nvd.nist.gov/vuln/detail/CVE-2024-8447
Code Behaviors & Features
Detect and mitigate CVE-2024-8447 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →