CVE-2024-8447
Narayana: deadlock via multiple join requests sent to lra coordinator
5.9 MediumFix available
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.68%Up 0.6 points since Jan 3, 2025
What each source reports
CVE List Score used
Narayana: deadlock via multiple join requests sent to lra coordinator
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
- Record
CVE-2024-8447- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
EUVDEUVD-2025-0041
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
- Record
EUVD-2025-0041- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qq9f-q439-2574
Narayana deadlock via multiple join requests sent to LRA Coordinator
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
- Record
GHSA-qq9f-q439-2574- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
NVD
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
- Record
CVE-2024-8447- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
OSV
Narayana: deadlock via multiple join requests sent to lra coordinator
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
- Record
CVE-2024-8447- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
OSVGHSA-qq9f-q439-2574
Narayana deadlock via multiple join requests sent to LRA Coordinator
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.
- Record
GHSA-qq9f-q439-2574- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-833
- Updated
- 2026-11-02
OSVRHSA-2025:3357
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update
- Record
RHSA-2025:3357- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
- red hat jboss data grid 7
- red hat jboss eap xp 5.0 update 2.0
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform 8.0 for rhel 8
- red hat jboss enterprise application platform 8.0 for rhel 9
- red hat jboss enterprise application platform expansion pack
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jboss.narayana.rts:lra-coordinator-jarMaven |
before 7.1.0.Final | 7.1.0.Final |
org.jboss.narayana.rts:lra-coordinator-jarMaven |
before 7.1.0.Final, plus listed versions 5.10.0.Final5.10.1.Final5.10.3.Final5.10.4.Final5.10.5.Final Show 24 moreShow less5.10.6.Final5.11.0.Final5.11.1.Final5.11.2.Final5.11.3.Final5.11.4.Final5.12.0.Final5.12.1.Final5.12.2.Final5.12.4.Final5.12.5.Final5.12.6.Final5.12.7.Final5.13.0.Final5.13.1.Alpha15.13.1.Final6.0.0.CR16.0.0.Final6.0.1.Final6.0.2.Final6.0.3.Final7.0.0.Final7.0.1.Final7.0.2.Final |
7.1.0.Final |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:800.6.1-1.GA_redhat_00001.1.el8eap | 0:800.6.1-1.GA_redhat_00001.1.el8eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:800.6.1-1.GA_redhat_00001.1.el8eap | 0:800.6.1-1.GA_redhat_00001.1.el8eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el8eap | 0:4.1.119-1.Final_redhat_00002.1.el8eap |
eap8-slf4jRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:2.0.16-2.redhat_00003.1.el8eap | 0:2.0.16-2.redhat_00003.1.el8eap |
eap8-slf4j-apiRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:2.0.16-2.redhat_00003.1.el8eap | 0:2.0.16-2.redhat_00003.1.el8eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el8eap | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
eap8-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el8eap | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el8eap | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el8eap | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.0::el8 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el8eap | 0:8.0.6-15.GA_redhat_00009.1.el8eap |
eap8-eap-product-conf-parentRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:800.6.1-1.GA_redhat_00001.1.el9eap | 0:800.6.1-1.GA_redhat_00001.1.el9eap |
eap8-eap-product-conf-wildfly-ee-feature-packRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:800.6.1-1.GA_redhat_00001.1.el9eap | 0:800.6.1-1.GA_redhat_00001.1.el9eap |
eap8-nettyRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-bufferRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-codecRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-codec-dnsRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-codec-httpRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-codec-socksRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-commonRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-handlerRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-handler-proxyRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-resolverRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-resolver-dnsRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-transportRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-transport-classes-epollRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-transport-native-epollRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-transport-native-epoll-debuginfoRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-netty-transport-native-unix-commonRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:4.1.119-1.Final_redhat_00002.1.el9eap | 0:4.1.119-1.Final_redhat_00002.1.el9eap |
eap8-slf4jRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:2.0.16-2.redhat_00003.1.el9eap | 0:2.0.16-2.redhat_00003.1.el9eap |
eap8-slf4j-apiRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:2.0.16-2.redhat_00003.1.el9eap | 0:2.0.16-2.redhat_00003.1.el9eap |
eap8-wildflyRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el9eap | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
eap8-wildfly-java-jdk11Red Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el9eap | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
eap8-wildfly-java-jdk17Red Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el9eap | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
eap8-wildfly-java-jdk21Red Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el9eap | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
eap8-wildfly-modulesRed Hat:jboss_enterprise_application_platform:8.0::el9 From an advisory covering 4 CVEs |
before 0:8.0.6-15.GA_redhat_00009.1.el9eap | 0:8.0.6-15.GA_redhat_00009.1.el9eap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-8447 is a medium vulnerability (CVSS 5.9) in Red Hat Jboss Data Grid 7, published January 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in org.jboss.narayana.rts:lra-coordinator-jar 7.1.0.Final.
References
access.redhat.com/errata/RHSA-2025:3357
bugzilla.redhat.com/show_bug.cgi?id=2335206
github.com/jbosstm/narayana/pull/2293
Show 31 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-8447
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0
issues.redhat.com/browse/JBEAP-29540
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3357.json
cve.org/CVERecord?id=CVE-2024-8447