CVE-2023-3171: Eap-7: heap exhaustion via deserialization
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
Other sources
It was found that EAP-7 would permit deserialization of certain classes, HashMap and HashTable, which could eventually exhaust the heap. An attacker could use this to conduct a Denial of Service attack targeting these classes.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3171?
CVE-2023-3171 is considered a high severity vulnerability due to the potential for heap exhaustion caused by deserialization flaws.
How do I fix CVE-2023-3171?
To fix CVE-2023-3171, you should upgrade to the latest patched version of Red Hat JBoss Enterprise Application Platform or apply the recommended security updates.
What impact does CVE-2023-3171 have on my application?
CVE-2023-3171 can lead to denial of service by exhausting heap memory if exploited through malicious requests.
Which versions of JBoss are affected by CVE-2023-3171?
CVE-2023-3171 specifically affects Red Hat JBoss Enterprise Application Platform version 7.4.
Are there any workarounds for CVE-2023-3171?
While a patch is the most effective solution for CVE-2023-3171, mitigating the risk may involve limiting access to the application to trusted sources.