JBossWS vulnerable to uncontrolled recursion

published 2013-07-28 13 y ago modified 2026-06-16 4 mo ago also GHSA-rj4p-7mm6-gm9j , EUVD-2022-5182

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits: 0; none known

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Patch / fix

fixed in 1 distros 1 links 1

maven org.jboss.ws:jbossws-common 2.1.0.Final

jbossas jboss enterprise application platform 4.2.0 4.2.0-6.GA_CP09.11.ep1.el4
jbossas jboss enterprise application platform 4.2.0 4.2.0-6.GA_CP09.11.1.ep1.el5
jbossas-client jboss enterprise application platform 4.2.0 4.2.0-6.GA_CP09.11.ep1.el4
jbossas-client jboss enterprise application platform 4.2.0 4.2.0-6.GA_CP09.11.1.ep1.el5
jbossas-4.2.0.GA_CP09-bin jboss enterprise application platform 4.2.0 4.2.0-6.GA_CP09.11.ep1.el4
jbossas-4.2.0.GA_CP09-bin jboss enterprise application platform 4.2.0 4.2.0-6.GA_CP09.11.1.ep1.el5
jbossws-common jboss enterprise application platform 4.3.0 1.0.0-5.GA_CP07_patch_01.1.ep1.el4
jbossws-common jboss enterprise application platform 4.3.0 1.0.0-5.GA_CP07_patch_01.1.ep1.el5

red hat advisories RHSA-2011:1309 RHSA-2011:1306 RHSA-2011:1303 RHSA-2011:1301

source.jboss.org/changelog/JBossWS/?cs=13996 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-1483 updated 2026-08-10 cvss 5.0

JBossWS remote Denial of Service

Red Hat JBoss BRMS 5 security
affected: no fix available
Red Hat JBoss Communications Platform 1.2 Red Hat JBoss Communications Platform 5.1
fixed: vendor fix RHSA-2011:1308
Red Hat JBoss Enterprise BRMS Platform 5.1
fixed: vendor fix RHSA-2011:1313
Red Hat JBoss Enterprise Application Platform 4.2
fixed: vendor fix RHSA-2011:1310
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jbossas 4.2.0-6.GA_CP09.11.ep1.el4, jbossas-client 4.2.0-6.GA_CP09.11.ep1.el4, jbossas-4.2.0.GA_CP09-bin 4.2.0-6.GA_CP09.11.ep1.el4 Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jbossas 4.2.0-6.GA_CP09.11.ep1.el4, jbossas-client 4.2.0-6.GA_CP09.11.ep1.el4, jbossas-4.2.0.GA_CP09-bin 4.2.0-6.GA_CP09.11.ep1.el4 Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jbossas 4.2.0-6.GA_CP09.11.1.ep1.el5, jbossas-client 4.2.0-6.GA_CP09.11.1.ep1.el5, jbossas-4.2.0.GA_CP09-bin 4.2.0-6.GA_CP09.11.1.ep1.el5
fixed: vendor fix RHSA-2011:1309
Red Hat JBoss Enterprise Application Platform 4.3
fixed: vendor fix RHSA-2011:1307
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jbossws-common 1.0.0-5.GA_CP07_patch_01.1.ep1.el4 Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jbossws-common 1.0.0-5.GA_CP07_patch_01.1.ep1.el4 Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jbossws-common 1.0.0-5.GA_CP07_patch_01.1.ep1.el5
fixed: vendor fix RHSA-2011:1306
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el6
fixed: vendor fix RHSA-2011:1301

show 6 more

Red Hat JBoss Enterprise Application Platform 5.1
fixed: vendor fix RHSA-2011:1302
Red Hat JBoss Portal 5
fixed: vendor fix RHSA-2011:1311
Red Hat JBoss SOA Platform 4.2 Red Hat JBoss SOA Platform 4.3 Red Hat JBoss SOA Platform 5.1
fixed: vendor fix RHSA-2011:1305
Red Hat JBoss Web Platform 5 for RHEL 5 Server jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el5 Red Hat JBoss Web Platform 5 for RHEL 6 Server jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el6
fixed: vendor fix RHSA-2011:1303
Red Hat JBoss Web Platform 5.1
fixed: vendor fix RHSA-2011:1304
Red Hat JBoss Web Platform 5 for RHEL 4 AS jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el4 Red Hat JBoss Web Platform 5 for RHEL 4 ES jbossws-common 1.1.0-4.SP7_patch_02.1.ep5.el4
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.66% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected packages

ecosystem	package	affected	fixed in
maven	org.jboss.ws:jbossws-common	<2.1.0.Final	2.1.0.Final

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

source.jboss.org /changelog/JBossWS/?cs=13996
web, patch
h20564.www2.hp.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583
vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=692584
web
nvd.nist.gov /vuln/detail/CVE-2011-1483
advisory
github.com /jbossws/jbossws-common
package

Sources

CVE List CVE-2011-1483
GitHub Advisory GHSA-rj4p-7mm6-gm9j
NVD CVE-2011-1483

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary