CVE-2010-4265
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run...
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.
Exploit likelihood
What each source reports
NVD Score used
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.
- Record
CVE-2010-4265- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.
- Record
CVE-2010-4265- Updated
- 2026-11-02
EUVDEUVD-2010-4238 No score
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.
- Record
EUVD-2010-4238- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q8wr-qfh4-ggjg No score
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run...
The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 through 4.3.0.CP09 allows remote attackers to cause a denial of service (daemon outage) by establishing a bisocket control connection TCP session, and then not sending any application data, related to a missing CVE-2010-3862 patch. NOTE: this can be considered a duplicate of CVE-2010-3862 because a missing patch should not be assigned a separate CVE identifier.
- Record
GHSA-q8wr-qfh4-ggjg- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el4 |
before 0:2.2.3-4.SP3.ep1.1.el4 | 0:2.2.3-4.SP3.ep1.1.el4 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el5 |
before 0:2.2.3-4.SP3.ep1.1.el5 | 0:2.2.3-4.SP3.ep1.1.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4265 is a low vulnerability (CVSS 2.6) in Redhat Jboss Enterprise Application Platform, published December 30, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in jboss-remoting 0:2.2.3-4.SP3.ep1.1.el4.
References
issues.jboss.org/browse/JBPAPP-5253
securitytracker.com/id?1024840
redhat.com/support/errata/RHSA-2010-0965.html
bugzilla.redhat.com/show_bug.cgi?id=660623
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2010-4265
github.com/advisories/GHSA-q8wr-qfh4-ggjg
access.redhat.com/errata/RHSA-2010:0964
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0964.json
cve.org/CVERecord?id=CVE-2010-4265