CVE-2020-25689: Missing Release of Memory after Effective Lifetime

May 24, 2022 (updated June 23, 2022)

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689
github.com/advisories/GHSA-97hp-6q9g-5cw2
nvd.nist.gov/vuln/detail/CVE-2020-25689
security.netapp.com/advisory/ntap-20201123-0006/

Code Behaviors & Features

Detect and mitigate CVE-2020-25689 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →