CVE-2011-1483
JBossWS vulnerable to uncontrolled recursion
CVE-2011-1483 is a medium vulnerability (CVSS 5.0) in Redhat Jboss Communications Platform, published July 28, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in org.jboss.ws:jbossws-common 2.1.0.Final.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.66%EPSS, 85th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.1.0.Finalorg.jboss.ws:jbossws-common +13 more
Description
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jboss.ws:jbossws-commonMaven | before 2.1.0.Final | 2.1.0.Final |
jbossws-commonRed Hat:jboss_enterprise_application_platform:5::el4 | before 0:1.1.0-4.SP7_patch_02.1.ep5.el4 | 0:1.1.0-4.SP7_patch_02.1.ep5.el4 |
jbossws-commonRed Hat:jboss_enterprise_application_platform:5::el5 | before 0:1.1.0-4.SP7_patch_02.1.ep5.el5 | 0:1.1.0-4.SP7_patch_02.1.ep5.el5 |
jbossws-commonRed Hat:jboss_enterprise_application_platform:5::el6 | before 0:1.1.0-4.SP7_patch_02.1.ep5.el6 | 0:1.1.0-4.SP7_patch_02.1.ep5.el6 |
jbossws-commonRed Hat:jboss_enterprise_web_platform:5::el5 | before 0:1.1.0-4.SP7_patch_02.1.ep5.el5 | 0:1.1.0-4.SP7_patch_02.1.ep5.el5 |
jbossws-commonRed Hat:jboss_enterprise_web_platform:5::el6 | before 0:1.1.0-4.SP7_patch_02.1.ep5.el6 | 0:1.1.0-4.SP7_patch_02.1.ep5.el6 |
jbossws-commonRed Hat:jboss_enterprise_application_platform:4.3.0::el4 | before 0:1.0.0-5.GA_CP07_patch_01.1.ep1.el4 | 0:1.0.0-5.GA_CP07_patch_01.1.ep1.el4 |
jbossws-commonRed Hat:jboss_enterprise_application_platform:4.3.0::el5 | before 0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5 | 0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5 |
jbossasRed Hat:jboss_enterprise_application_platform:4.2.0::el4 | before 0:4.2.0-6.GA_CP09.11.ep1.el4 | 0:4.2.0-6.GA_CP09.11.ep1.el4 |
jbossas-4.2.0.GA_CP09-binRed Hat:jboss_enterprise_application_platform:4.2.0::el4 | before 0:4.2.0-6.GA_CP09.11.ep1.el4 | 0:4.2.0-6.GA_CP09.11.ep1.el4 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.2.0::el4 | before 0:4.2.0-6.GA_CP09.11.ep1.el4 | 0:4.2.0-6.GA_CP09.11.ep1.el4 |
jbossasRed Hat:jboss_enterprise_application_platform:4.2.0::el5 | before 0:4.2.0-6.GA_CP09.11.1.ep1.el5 | 0:4.2.0-6.GA_CP09.11.1.ep1.el5 |
jbossas-4.2.0.GA_CP09-binRed Hat:jboss_enterprise_application_platform:4.2.0::el5 | before 0:4.2.0-6.GA_CP09.11.1.ep1.el5 | 0:4.2.0-6.GA_CP09.11.1.ep1.el5 |
jbossas-clientRed Hat:jboss_enterprise_application_platform:4.2.0::el5 | before 0:4.2.0-6.GA_CP09.11.1.ep1.el5 | 0:4.2.0-6.GA_CP09.11.1.ep1.el5 |
What each source reports
NVD Score used
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
- Record
CVE-2011-1483- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE ListNo score
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
- Record
CVE-2011-1483- Updated
- 2026-11-02
EUVDEUVD-2022-5182No score
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
- Record
EUVD-2022-5182- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rj4p-7mm6-gm9jNo score
JBossWS vulnerable to uncontrolled recursion
DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
- Record
GHSA-rj4p-7mm6-gm9j- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-rj4p-7mm6-gm9jNo score
JBossWS vulnerable to uncontrolled recursion
DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
- Record
GHSA-rj4p-7mm6-gm9j- Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
source.jboss.org/changelog/JBossWS?cs=13996
h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583
bugzilla.redhat.com/show_bug.cgi?id=692584
nvd.nist.gov/vuln/detail/CVE-2011-1483
github.com/advisories/GHSA-rj4p-7mm6-gm9j
Show 11 moreShow less
access.redhat.com/errata/RHSA-2011:1301
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1301.json
cve.org/CVERecord?id=CVE-2011-1483