Skip to content
Fencer Intel
low 2.6

CVE-2010-3862 json

The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3…

published 15y ago modified 4mo ago also EUVD-2010-3841

cvss
2.6
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09, and 5.1.0; and JBoss Enterprise Web Platform (aka JBEWP) 5.1.0; allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data.

Patch / fix

  • jbossws-cxf jboss enterprise web platform 5, jboss enterprise application platform 5 3.1.2-4.SP7.6.jdk6.ep5.el5
  • jopr-embedded jboss enterprise web platform 5, jboss enterprise application platform 5 1.3.4-16.SP1.7.ep5.el5
  • jboss-remoting jboss enterprise web platform 5, jboss enterprise application platform 5 2.5.3-5.SP1.1.ep5.el5
  • jbossas-security-policy-cc jboss enterprise application platform 5 5.1.0-1.ep5.el5
  • jbossws-cxf jboss enterprise application platform 5 3.1.2-4.SP7.6.jdk6.ep5.el4
  • jopr-embedded jboss enterprise application platform 5 1.3.4-16.SP1.7.ep5.el4
  • jboss-remoting jboss enterprise application platform 5 2.5.3-5.SP1.1.ep5.el4
  • jbossas-security-policy-cc jboss enterprise application platform 5 5.1.0-1.ep5.el4

red hat advisories RHSA-2010:0961RHSA-2010:0960RHSA-2010:0959RHSA-2010:0938RHSA-2010:0937

Is CVE-2010-3862 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2010-3862 updated cvss 2.6

JBoss Remoting Denial-Of-Service

  • Red Hat JBoss Enterprise Application Platform 4.3
    fixed: vendor fix RHSA-2010:0939
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jgroups 2.4.9-1.ep1.el4, xalan-j2 2.7.1-4.ep1.1.el4, javassist 3.9.0-2.ep1.1.el4, jboss-common 1.2.2-1.ep1.1.el4, jboss-seam2 2.0.2.FP-1.ep1.26.el4, jbossas 4.3.0-8.GA_CP09.2.ep1.el4, +16 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jgroups 2.4.9-1.ep1.el4, xalan-j2 2.7.1-4.ep1.1.el4, javassist 3.9.0-2.ep1.1.el4, jboss-common 1.2.2-1.ep1.1.el4, jboss-seam2 2.0.2.FP-1.ep1.26.el4, jbossas 4.3.0-8.GA_CP09.2.ep1.el4, +16 more
    fixed: vendor fix RHSA-2010:0937
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jgroups 2.4.9-1.ep1.el5, xalan-j2 2.7.1-4.ep1.1.el5, javassist 3.9.0-2.ep1.1.el5, jboss-common 1.2.2-1.ep1.1.el5, jboss-seam2 2.0.2.FP-1.ep1.26.el5, jboss-remoting 2.2.3-4.SP3.ep1.el5, +17 more
    fixed: vendor fix RHSA-2010:0938
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jboss-remoting 2.5.3-5.SP1.1.ep5.el4, jopr-embedded 1.3.4-16.SP1.7.ep5.el4, jbossws-cxf 3.1.2-4.SP7.6.jdk6.ep5.el4, jbossas-security-policy-cc 5.1.0-1.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jboss-remoting 2.5.3-5.SP1.1.ep5.el4, jopr-embedded 1.3.4-16.SP1.7.ep5.el4, jbossws-cxf 3.1.2-4.SP7.6.jdk6.ep5.el4, jbossas-security-policy-cc 5.1.0-1.ep5.el4
    fixed: vendor fix RHSA-2010:0959
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jboss-remoting 2.5.3-5.SP1.1.ep5.el5, jopr-embedded 1.3.4-16.SP1.7.ep5.el5, jbossws-cxf 3.1.2-4.SP7.6.jdk6.ep5.el5, jbossas-security-policy-cc 5.1.0-1.ep5.el5
    fixed: vendor fix RHSA-2010:0960
  • Red Hat JBoss Enterprise Application Platform 5.1
    fixed: vendor fix RHSA-2010:0963
  • Red Hat JBoss Web Platform 5 for RHEL 5 Server jboss-remoting 2.5.3-5.SP1.1.ep5.el5, jopr-embedded 1.3.4-16.SP1.7.ep5.el5, jbossws-cxf 3.1.2-4.SP7.6.jdk6.ep5.el5
    fixed: vendor fix RHSA-2010:0961
  • Red Hat JBoss Web Platform 5.1
    fixed: vendor fix RHSA-2010:0962
show 1 more
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS jboss-remoting 2.5.3-5.SP1.1.ep5.el4, jopr-embedded 1.3.4-16.SP1.7.ep5.el4, jbossws-cxf 3.1.2-4.SP7.6.jdk6.ep5.el4 Red Hat JBoss Web Platform 5 for RHEL 4 ES jboss-remoting 2.5.3-5.SP1.1.ep5.el4, jopr-embedded 1.3.4-16.SP1.7.ep5.el4, jbossws-cxf 3.1.2-4.SP7.6.jdk6.ep5.el4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.61% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.