CVE-2020-14340: Uncontrolled Resource Consumption in XNIO
Summary
CVE-2020-14340: Uncontrolled Resource Consumption in XNIO. Affects org.jboss.xnio:xnio-nio across 2 version ranges.
>= 3.6.0, < 3.7.9.Final
>= 3.8.0.Final, < 3.8.2.Final
Fixed in 3.7.9.Final or 3.8.2.Final, depending on the release line you run. How to fix ↓
Also tracked for
- jboss-xnio · Debian:11
The same CVE-2020-14340 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XNIO is a library that provides a high-performance I/O abstraction for Java applications. It is commonly used for networking and communication tasks. This vulnerability affects versions 3.6.0.Beta1 through 3.8.1.Final of the XNIO library. The vulnerability arises from a file descriptor leak, which leads to a growing number of NIO Selector file handles between garbage collection cycles. This issue can be exploited by an attacker to cause a denial of service.
Vulnerability Detail
The vulnerability in XNIO allows for uncontrolled resource consumption due to a file descriptor leak. As the number of NIO Selector file handles grows over time, it can lead to resource exhaustion and impact the availability of the affected application. This can result in a denial of service condition, rendering the application unresponsive. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.6.0, < 3.7.9.Final3.7.9.Final -
>= 3.8.0.Final, < 3.8.2.Final3.8.2.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to a patched version of XNIO.
Conclusion
In conclusion, the XNIO library is vulnerable to uncontrolled resource consumption due to a file descriptor leak. This can result in a denial of service condition. It is crucial for developers to upgrade to a patched version of XNIO, specifically version 3.8.2.Final or later, to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.xnio:xnio-nio →
FAQ
XNIO is a Java library that provides a high-performance I/O abstraction for networking and communication tasks.
The vulnerability can lead to a denial of service, causing the affected application to become unresponsive.
Versions 3.6.0.Beta1 through 3.8.1.Final of XNIO are affected by this vulnerability.
To fix this vulnerability, upgrade to XNIO version 3.8.2.Final or later.
No, there is no known workaround for this vulnerability. Upgrading to a fixed version is necessary.
