CVE-2016-9589 Red Hat Wildfly DoS
Attackers can exhaust server memory via HTTP header cache exploitation in WildFly, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9589?
CVE-2016-9589 is a high-severity denial of service vulnerability in Red Hat, Inc. wildfly, published on 12 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.
Weakness: CWE-400
Which versions are affected by CVE-2016-9589?
2 open source packages ship an affected version, including org.wildfly:wildfly-undertow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.wildfly:wildfly-undertow Maven | All versions | 11.0.0.Beta1 |
org.wildfly:wildfly-undertow Maven | All versions | 11.0.0.Beta1 |
Products include Redhat Jboss Wildfly Application Server.
How do I fix CVE-2016-9589?
Upgrade org.wildfly:wildfly-undertow to 11.0.0.Beta1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-9589 being exploited?
There is no known exploitation of CVE-2016-9589 in the wild and no public exploit code.
Other vulnerabilities in Red Hat, Inc. wildfly
Sources
Also known as GHSA-p4xg-cpr9-vwvj.