Eap-7: heap exhaustion via deserialization

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

未经控制的内存分配

Red Hat EAP 7 安全漏洞

Red Hat EAP 7是美国红帽（Red Hat）公司的一个构建在开放标准上并和Java EE 7 规格兼容的中间件平台。 Red Hat EAP 7 存在安全漏洞，该漏洞源于在某些类的反序列化过程中发现了一个缺陷，该缺陷允许实例化 HashMap 和 HashTable，而不检查所消耗的资源，攻击者利用该漏洞可以使用这些类提交恶意请求，耗尽堆并导致拒绝服务。

N/A

N/A