{"id":"CVE-2011-1483","aliases":["EUVD-2022-5182","GHSA-rj4p-7mm6-gm9j","RHSA-2011:1301","RHSA-2011:1303","RHSA-2011:1306","RHSA-2011:1309"],"status":"published","title":"JBossWS vulnerable to uncontrolled recursion","description":"wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02664,"percentile":0.85816,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2013-07-28T18:00:00Z","modified":"2026-08-05T10:01:33Z","fixes":[{"ecosystem":"Maven","package":"org.jboss.ws:jbossws-common","fixed_in":["2.1.0.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossws-common","fixed_in":["0:1.1.0-4.SP7_patch_02.1.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossws-common","fixed_in":["0:1.1.0-4.SP7_patch_02.1.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossws-common","fixed_in":["0:1.1.0-4.SP7_patch_02.1.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossws-common","fixed_in":["0:1.1.0-4.SP7_patch_02.1.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossws-common","fixed_in":["0:1.1.0-4.SP7_patch_02.1.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossws-common","fixed_in":["0:1.0.0-5.GA_CP07_patch_01.1.ep1.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossws-common","fixed_in":["0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas","fixed_in":["0:4.2.0-6.GA_CP09.11.ep1.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-4.2.0.GA_CP09-bin","fixed_in":["0:4.2.0-6.GA_CP09.11.ep1.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-client","fixed_in":["0:4.2.0-6.GA_CP09.11.ep1.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas","fixed_in":["0:4.2.0-6.GA_CP09.11.1.ep1.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-4.2.0.GA_CP09-bin","fixed_in":["0:4.2.0-6.GA_CP09.11.1.ep1.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-client","fixed_in":["0:4.2.0-6.GA_CP09.11.1.ep1.el5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jboss.ws:jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jboss.ws:jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0.Final"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-4.SP7_patch_02.1.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-4.SP7_patch_02.1.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-4.SP7_patch_02.1.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-4.SP7_patch_02.1.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-4.SP7_patch_02.1.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el4","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.GA_CP07_patch_01.1.ep1.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.3.0::el5","package":"jbossws-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.GA_CP07_patch_01.1.ep1.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.11.ep1.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-4.2.0.GA_CP09-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.11.ep1.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el4","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.11.ep1.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.11.1.ep1.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-4.2.0.GA_CP09-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.11.1.ep1.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:4.2.0::el5","package":"jbossas-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-6.GA_CP09.11.1.ep1.el5"}]}]}],"products":[{"vendor":"hp","product":"network_node_manager_i"},{"vendor":"redhat","product":"jboss_communications_platform"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_brms_platform"},{"vendor":"redhat","product":"jboss_enterprise_portal_platform"},{"vendor":"redhat","product":"jboss_enterprise_soa_platform"},{"vendor":"redhat","product":"jboss_enterprise_web_platform"}],"references":[{"url":"http://source.jboss.org/changelog/JBossWS/?cs=13996","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03824583","tags":["vendor-advisory","x_refsource_HP","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=692584","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1483","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rj4p-7mm6-gm9j"},{"url":"https://github.com/jbossws/jbossws-common","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1301","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1301.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-1483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-1483","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1303","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1303.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1306","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1306.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1309","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1309.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-1483","description":"wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2013-07-28T18:00:00Z","modified":"2024-08-06T22:28:41.626Z","updated_at":"2026-11-02T14:35:38.321377Z"}],"euvd":[{"id":"EUVD-2022-5182","description":"wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2013-07-28T18:00:00Z","modified":"2024-08-06T22:28:41Z","updated_at":"2026-11-03T01:55:56.243798Z"}],"ghsa":[{"id":"GHSA-rj4p-7mm6-gm9j","title":"JBossWS vulnerable to uncontrolled recursion","description":"DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2022-05-13T01:39:29Z","modified":"2023-01-29T05:03:44Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:25.835323Z"}],"nvd":[{"id":"CVE-2011-1483","description":"wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2013-07-29T13:59:54.843Z","modified":"2026-06-16T23:29:28.26Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:12.639283Z"}],"osv":[{"id":"GHSA-rj4p-7mm6-gm9j","title":"JBossWS vulnerable to uncontrolled recursion","description":"DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.","status":"published","published":"2022-05-13T01:39:29Z","modified":"2023-11-08T03:56:59.214188Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"RHSA-2011:1301","title":"Red Hat Security Advisory: jbossws-common security update","status":"published","published":"2024-09-15T19:19:36Z","modified":"2026-08-05T10:01:31Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:1303","title":"Red Hat Security Advisory: jbossws-common security update","status":"published","published":"2024-09-15T19:19:44Z","modified":"2026-08-05T10:01:32Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:1306","title":"Red Hat Security Advisory: jbossws-common security update","status":"published","published":"2024-09-15T19:19:57Z","modified":"2026-08-05T10:01:32Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:1309","title":"Red Hat Security Advisory: jbossas security update","status":"published","published":"2024-09-15T19:20:09Z","modified":"2026-08-05T10:01:33Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}