CVE-2010-3862: The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in J...

Security readout for executives and security teams

This is a remote denial-of-service flaw in older JBoss Remoting used by Red Hat JBoss EAP and EWP. An attacker who can reach the bisocket control connection can make the service stop responding by opening a TCP session and withholding application data. It affects availability, not data theft based on the sources. Exposure is most likely in legacy Red Hat JBoss EAP 4.3 through 4.3.0.CP09, EAP 5.1.0, or JBoss EWP 5.1.0 deployments using affected JBoss Remoting bisocket transport. Internet-facing or partner-accessible remoting endpoints raise urgency. Treat this as a targeted availability risk for legacy JBoss environments. It is not presented as data compromise or code execution, but exposed production middleware could suffer service outage. Prioritize remediation where affected JBoss Remoting endpoints support revenue, authentication, or customer-facing services. Mitigation focus: Upgrade JBoss Remoting to 2.2.3.SP4, 2.5.3.SP2, or later vendor-supported packages.; Apply the relevant Red Hat security advisories for the deployed EAP or EWP stream.; Restrict network access to JBoss Remoting bisocket endpoints to trusted systems only..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.