CVE-2025-2251: Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2251?
CVE-2025-2251 has been rated as critical due to its potential to allow remote code execution via untrusted data deserialization.
How do I fix CVE-2025-2251?
To fix CVE-2025-2251, update WildFly or JBoss EAP to the latest patched version provided by Red Hat.
Which versions of WildFly are affected by CVE-2025-2251?
CVE-2025-2251 affects multiple versions of WildFly prior to the security update addressing this vulnerability.
Can CVE-2025-2251 lead to data breaches?
Yes, exploitation of CVE-2025-2251 could lead to unauthorized access and potential data breaches.
Is CVE-2025-2251 related to Java security?
Yes, CVE-2025-2251 is related to a flaw in the Java serialization process used by JBoss Marshalling.