{"id":"CVE-2024-41172","aliases":["EUVD-2024-2246","GHSA-4mgg-fqfq-64hg","RHSA-2024:8823","RHSA-2024:8824"],"status":"published","title":"Apache CXF: Unrestricted memory consumption in CXF HTTP clients","description":"In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01197,"percentile":0.68501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2024-07-19T08:50:43Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-transports-http","fixed_in":["4.0.5","3.6.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-transports-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-transports-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-transports-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-transports-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.4"}]}],"versions":["3.6.0","3.6.1","3.6.2","3.6.3"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-jakarta-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-jakarta-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-jakarta-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-jakarta-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-2.redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-aesh-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.0-2.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-aesh-readline","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-commons-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.redhat_00007.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-28.redhat_2.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-commons-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.1-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.redhat_00006.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-cxf-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-cxf-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-cxf-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-artemis-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-2.redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-artemis-native-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-2.redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-artemis-wildfly-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-asyncutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.redhat_00010.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-aws-java-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-aws-java-sdk-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-aws-java-sdk-kms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-aws-java-sdk-s3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-cryptacular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.5-2.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.4.0-1.GA_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.4.0-1.GA_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-4.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-hibernate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-hibernate-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-hibernate-envers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-hppc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-2.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jakarta-servlet-jsp-jstl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jakarta-servlet-jsp-jstl-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jctools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.2-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jctools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.2-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jgroups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.10-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-jmespath-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.22.1-1.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-jbosstxbridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-jbossxts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-jts-idlj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-jts-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-restat-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-restat-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-restat-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-narayana-restat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-nimbus-jose-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.37.3-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-objectweb-asm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.0-1.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-objectweb-asm-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.0-1.redhat_00002.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-pem-keystore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-resteasy-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-3.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-resteasy-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-resteasy-tracing-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-3.Final_redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-saaj-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-shibboleth-java-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.0-6.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-slf4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-1.redhat_00001.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el8eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-jakarta-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-jakarta-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-jakarta-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-jakarta-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-2.redhat_00005.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33.0-1.redhat_00015.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-aesh-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.0-2.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-aesh-readline","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-2.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-commons-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-2.redhat_00007.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-commons-collections","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-28.redhat_2.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-commons-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.1-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.redhat_00006.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-cxf-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-cxf-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-cxf-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.5-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-artemis-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-2.redhat_00005.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-artemis-native-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.0-2.redhat_00005.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-artemis-wildfly-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-1.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-asyncutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.redhat_00010.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-aws-java-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-aws-java-sdk-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-aws-java-sdk-kms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-aws-java-sdk-s3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-cryptacular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.5-2.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.4.0-1.GA_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.4.0-1.GA_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-fastinfoset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-4.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-hibernate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-hibernate-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-hibernate-envers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.31-1.Final_redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-hppc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-2.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jakarta-servlet-jsp-jstl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jakarta-servlet-jsp-jstl-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jboss-logging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jctools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.2-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jctools-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.2-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jgroups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.10-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-jmespath-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.284-2.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.22.1-1.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-jbosstxbridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-jbossxts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-jts-idlj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-jts-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-restat-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-restat-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-restat-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-narayana-restat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.3-1.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-nimbus-jose-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.37.3-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-objectweb-asm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.0-1.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-objectweb-asm-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.6.0-1.redhat_00002.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-pem-keystore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-resteasy-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-3.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-resteasy-spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-resteasy-tracing-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-3.Final_redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-saaj-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-shibboleth-java-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.0-6.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-slf4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.0-1.redhat_00001.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el9eap"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.4-2.GA_redhat_00005.1.el9eap"}]}],"bundled":7}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20240808-0008/","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/18/4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41172","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4mgg-fqfq-64hg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41172.json","tags":["advisory"]},{"url":"https://github.com/apache/cxf","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8823","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2298829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2309764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2311641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312511","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-24945","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-25035","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27002","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27194","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27247","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27276","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27293","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27392","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27543","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27585","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27643","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27659","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27688","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27694","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27957","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-28057","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-28278","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-28289","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8823.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52428","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52428","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52428","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4029","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x7g6-rwhc-g7mj","tags":["advisory"]},{"url":"https://github.com/wildfly/wildfly/pull/17914","tags":["article"]},{"url":"https://github.com/wildfly/wildfly/pull/17935","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8698","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8883","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8883","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8883","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41172","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41172","tags":["advisory"]},{"url":"https://osv.dev/vulnerability/GHSA-4mgg-fqfq-64hg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2316271","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47554","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47554","tags":["advisory"]},{"url":"https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8824","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-27248","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8824.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-41172","title":"Apache CXF: Unrestricted memory consumption in CXF HTTP clients","description":"In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory\n","status":"published","published":"2024-07-19T08:50:43.766Z","modified":"2024-09-13T17:05:12.209Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2024-2246","description":"In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory\n","status":"published","published":"2024-07-19T08:50:43Z","modified":"2024-09-13T17:05:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:55.467153Z"}],"ghsa":[{"id":"GHSA-4mgg-fqfq-64hg","title":"Apache CXF allows unrestricted memory consumption in CXF HTTP clients","description":"In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory\n","status":"published","published":"2024-07-19T09:32:06Z","modified":"2024-11-18T16:26:54Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:38:20.012356Z"}],"nvd":[{"id":"CVE-2024-41172","description":"In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory\n","status":"published","published":"2024-07-19T09:15:05.64Z","modified":"2026-06-17T07:47:24.737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:10:13.413515Z"}],"osv":[{"id":"CVE-2024-41172","title":"Apache CXF: Unrestricted memory consumption in CXF HTTP clients","description":"In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory\n","status":"published","published":"2024-07-19T08:50:43.766Z","modified":"2026-10-28T02:31:14.731301308Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"GHSA-4mgg-fqfq-64hg","title":"Apache CXF allows unrestricted memory consumption in CXF HTTP clients","description":"In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory\n","status":"published","published":"2024-07-19T09:32:06Z","modified":"2024-11-27T05:53:51.05968Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"RHSA-2024:8823","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update","status":"published","published":"2026-08-05T10:22:32Z","modified":"2026-10-14T10:05:34Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8824","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update","status":"published","published":"2024-11-15T21:24:12Z","modified":"2026-10-14T10:05:34Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"}]}}