Vulnerability · Published Apr 7, 2025 · Assigned by redhat
CVE-2025-2251Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution
Medium 6.2
In plain English
A medium-severity unsafe deserialization in wildfly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Official description
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H
References
- RHSA-2025:10452 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10453 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10459 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10924 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10925 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10926 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10931 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-2251 vdb-entry, x_refsource_REDHAT
- RHBZ#2351678 issue-tracking, x_refsource_REDHAT
- https://github.com/wildfly/wildfly/pull/18872
- https://github.com/wildfly/wildfly/releases/tag/36.0.0.Final
- https://issues.redhat.com/browse/WFLY-20550