{"id":"CVE-2024-8447","aliases":["EUVD-2025-0041","GHSA-qq9f-q439-2574","RHSA-2025:3357"],"status":"published","title":"Narayana: deadlock via multiple join requests sent to lra coordinator","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00681,"percentile":0.52694,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-833"],"published":"2025-01-02T20:19:29Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"Maven","package":"org.jboss.narayana.rts:lra-coordinator-jar","fixed_in":["7.1.0.Final"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jboss.narayana.rts:lra-coordinator-jar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jboss.narayana.rts:lra-coordinator-jar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.Final"}]}],"versions":["5.10.0.Final","5.10.1.Final","5.10.3.Final","5.10.4.Final","5.10.5.Final","5.10.6.Final","5.11.0.Final","5.11.1.Final","5.11.2.Final","5.11.3.Final","5.11.4.Final","5.12.0.Final","5.12.1.Final","5.12.2.Final","5.12.4.Final","5.12.5.Final","5.12.6.Final","5.12.7.Final","5.13.0.Final","5.13.1.Alpha1","5.13.1.Final","6.0.0.CR1","6.0.0.Final","6.0.1.Final","6.0.2.Final","6.0.3.Final","7.0.0.Final","7.0.1.Final","7.0.2.Final"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.6.1-1.GA_redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.6.1-1.GA_redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-transport-native-epoll-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-2.redhat_00003.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-slf4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-2.redhat_00003.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.6.1-1.GA_redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:800.6.1-1.GA_redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-transport-native-epoll-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.119-1.Final_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-2.redhat_00003.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-slf4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.16-2.redhat_00003.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.6-15.GA_redhat_00009.1.el9eap"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat jboss data grid 7"},{"vendor":"red hat","product":"red hat jboss eap xp 5.0 update 2.0"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.0 for rhel 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.0 for rhel 9"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:3357","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3358","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7620","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8447","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2335206","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/jbosstm/narayana/pull/2293","tags":["fix","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8447","tags":["advisory"]},{"url":"https://github.com/jbosstm/narayana/commit/eb778412de230afc4687a2df43641280494156c5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qq9f-q439-2574"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://github.com/jbosstm/narayana/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8447.json","tags":["advisory"]},{"url":"https://github.com/jbosstm/narayana","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0","tags":["article"]},{"url":"https://access.redhat.com/articles/7109353","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2325538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2344787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2344788","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-29540","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3357.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8447","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47535","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47535","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3","tags":["article"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-24970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","tags":["article"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-25193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-25193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25193","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386","tags":["article"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2024-8447","title":"Narayana: deadlock via multiple join requests sent to lra coordinator","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","status":"published","published":"2025-01-02T20:19:29.671Z","modified":"2026-09-07T14:22:43.17Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-833"],"updated_at":"2026-11-02T14:34:09.540667Z"}],"euvd":[{"id":"EUVD-2025-0041","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","status":"published","published":"2025-01-02T20:19:29Z","modified":"2026-09-07T14:22:43Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-qq9f-q439-2574","title":"Narayana deadlock via multiple join requests sent to LRA Coordinator","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","status":"published","published":"2025-01-02T21:31:42Z","modified":"2025-05-15T00:30:26Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-833"],"updated_at":"2026-11-02T14:38:43.172412Z"}],"nvd":[{"id":"CVE-2024-8447","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","status":"published","published":"2025-01-02T21:15:10.303Z","modified":"2026-09-07T15:17:29.96Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-833"],"updated_at":"2026-11-02T14:10:41.489236Z"}],"osv":[{"id":"CVE-2024-8447","title":"Narayana: deadlock via multiple join requests sent to lra coordinator","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","status":"published","published":"2025-01-02T20:19:29.671Z","modified":"2026-10-28T02:31:03.557754299Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-833"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"GHSA-qq9f-q439-2574","title":"Narayana deadlock via multiple join requests sent to LRA Coordinator","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","status":"published","published":"2025-01-02T21:31:42Z","modified":"2025-05-15T01:25:51.843294Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-833"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"RHSA-2025:3357","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update","status":"published","published":"2025-03-28T10:04:22Z","modified":"2026-10-20T10:03:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"}]}}