Every CVE Search/ Get API key

CVE-2011-1483

JBossWS vulnerable to uncontrolled recursion

5.0 MediumFix available

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Exploit likelihood

2.66%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Record
CVE-2011-1483
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Record
CVE-2011-1483
Updated
2026-11-02
EUVDEUVD-2022-5182 No score

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Record
EUVD-2022-5182
Updated
2026-11-03
GitHub AdvisoriesGHSA-rj4p-7mm6-gm9j No score

JBossWS vulnerable to uncontrolled recursion

DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Record
GHSA-rj4p-7mm6-gm9j
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-rj4p-7mm6-gm9j No score

JBossWS vulnerable to uncontrolled recursion

DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Record
GHSA-rj4p-7mm6-gm9j
Weakness
CWE-400
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jboss.ws:jbossws-common
Maven
 before 2.1.0.Final
2.1.0.Final
jbossws-common
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:1.1.0-4.SP7_patch_02.1.ep5.el4
0:1.1.0-4.SP7_patch_02.1.ep5.el4
jbossws-common
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:1.1.0-4.SP7_patch_02.1.ep5.el5
0:1.1.0-4.SP7_patch_02.1.ep5.el5
jbossws-common
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:1.1.0-4.SP7_patch_02.1.ep5.el6
0:1.1.0-4.SP7_patch_02.1.ep5.el6
jbossws-common
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:1.1.0-4.SP7_patch_02.1.ep5.el5
0:1.1.0-4.SP7_patch_02.1.ep5.el5
jbossws-common
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:1.1.0-4.SP7_patch_02.1.ep5.el6
0:1.1.0-4.SP7_patch_02.1.ep5.el6
jbossws-common
Red Hat:jboss_enterprise_application_platform:4.3.0::el4
 before 0:1.0.0-5.GA_CP07_patch_01.1.ep1.el4
0:1.0.0-5.GA_CP07_patch_01.1.ep1.el4
jbossws-common
Red Hat:jboss_enterprise_application_platform:4.3.0::el5
 before 0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5
0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5
jbossas
Red Hat:jboss_enterprise_application_platform:4.2.0::el4
 before 0:4.2.0-6.GA_CP09.11.ep1.el4
0:4.2.0-6.GA_CP09.11.ep1.el4
jbossas-4.2.0.GA_CP09-bin
Red Hat:jboss_enterprise_application_platform:4.2.0::el4
 before 0:4.2.0-6.GA_CP09.11.ep1.el4
0:4.2.0-6.GA_CP09.11.ep1.el4
Show 4 moreShow less
Affected packages
PackageAffectedFixed
jbossas-client
Red Hat:jboss_enterprise_application_platform:4.2.0::el4
 before 0:4.2.0-6.GA_CP09.11.ep1.el4
0:4.2.0-6.GA_CP09.11.ep1.el4
jbossas
Red Hat:jboss_enterprise_application_platform:4.2.0::el5
 before 0:4.2.0-6.GA_CP09.11.1.ep1.el5
0:4.2.0-6.GA_CP09.11.1.ep1.el5
jbossas-4.2.0.GA_CP09-bin
Red Hat:jboss_enterprise_application_platform:4.2.0::el5
 before 0:4.2.0-6.GA_CP09.11.1.ep1.el5
0:4.2.0-6.GA_CP09.11.1.ep1.el5
jbossas-client
Red Hat:jboss_enterprise_application_platform:4.2.0::el5
 before 0:4.2.0-6.GA_CP09.11.1.ep1.el5
0:4.2.0-6.GA_CP09.11.1.ep1.el5

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-1483 is a medium vulnerability (CVSS 5.0) in Redhat Jboss Communications Platform, published July 28, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.66%, the 85th percentile. Fixed in org.jboss.ws:jbossws-common 2.1.0.Final.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open