CVE-2016-7046: High severity jboss enterprise application platform vulnerability
A long URL when sent to EAP 7 Server operating as a reverse proxy with default buffer sizes causes a DoS.
A long URL (about 1900 characters) is sent, the proxy server
return error 500 (that's ok) starts to consume 100% CPU starts to fill logs log file with exceptions very fast (so disk space gets exhausted quickly) E.g. some infinite loop is initiated by the request. Proxy server must be restarted to stop the problem.
Other sources
Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7046?
CVE-2016-7046 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-7046?
To fix CVE-2016-7046, increase the buffer sizes in the JBoss EAP 7 configuration to handle longer URLs appropriately.
What type of attack does CVE-2016-7046 allow?
CVE-2016-7046 allows remote attackers to execute a denial of service attack through excessive CPU and disk consumption.
Which version of JBoss EAP is affected by CVE-2016-7046?
CVE-2016-7046 affects Red Hat JBoss Enterprise Application Platform version 7.0.
Is CVE-2016-7046 a local or remote vulnerability?
CVE-2016-7046 is a remote vulnerability that can be exploited by attackers over the network.