wildfly vulnerabilities and fixes

Recent CVEs affecting wildfly, with upgrade or downgrade steps. 17 tracked.

wildfly has 17 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 11. Most recent: 2025-01-30. Highest priority: CVE-2018-10683 (score 69/100).

• CVE-2025-23367 MEDIUM 6.5 UPGRADE UPGRADE A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider
• CVE-2022-1278 HIGH 7.5 UPGRADE DOWNGRADE A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the tra
• CVE-2022-0866 MEDIUM 5.3 DOWNGRADE DOWNGRADE This is a concurrency issue that can result in the wrong caller principal being returned from the session cont
• CVE-2021-3644 LOW 3.3 DOWNGRADE DOWNGRADE A flaw was found in wildfly-core in all versions
• CVE-2021-3503 MEDIUM 4.3 UPGRADE A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data
• CVE-2020-27822 MEDIUM 5.9 DOWNGRADE A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.
• CVE-2020-25640 MEDIUM 5.3 UPGRADE A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at w
• CVE-2020-1719 MEDIUM 5.4 UPGRADE A flaw was found in wildfly
• CVE-2020-14317 MEDIUM 5.5 MITIGATE MITIGATE It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enter
• CVE-2020-10740 MEDIUM 6.6 UPGRADE A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is
• CVE-2020-10718 HIGH 7.5 DOWNGRADE UPGRADE A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has a
• CVE-2019-3894 HIGH 8.8 UPGRADE DOWNGRADE It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 store
• CVE-2019-3805 MEDIUM 4.7 DOWNGRADE UPGRADE A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to exec
• CVE-2019-14887 CRITICAL 9.1 DOWNGRADE DOWNGRADE A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the
• CVE-2018-14627 MEDIUM 5.3 UPGRADE The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport i
• CVE-2018-10683 CRITICAL 9.8 DOWNGRADE An issue was discovered in WildFly 10.1.2.Final
• CVE-2018-10682 CRITICAL 9.8 DOWNGRADE An issue was discovered in WildFly 10.1.2.Final

FAQ

How do I fix wildfly vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is wildfly being exploited right now?

None of the tracked wildfly CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which wildfly CVE should I patch first?

CVE-2018-10683 currently ranks highest (69/100): An issue was discovered in WildFly 10.1.2.Final.

RSS feed for wildfly · ← Back to latest CVEs