Security readout for executives and security teams
Plain-English summary
A remote, unauthenticated attacker may disrupt affected JBoss EAP services by repeatedly sending oversized AJP requests. The backend closes connections without responding, causing the front-end cluster proxy to mark application servers unavailable and stop forwarding traffic. This can create a denial of service; the supplied evidence does not establish data theft or active exploitation.
Executive priority
Prioritize affected externally reachable or business-critical JBoss clusters. Patch through Red Hat’s applicable advisories and verify every node. Treat this as an availability risk rather than a confirmed confidentiality breach. If exposure is isolated and compensating controls prevent untrusted AJP traffic, schedule remediation promptly within normal high-severity timelines.
Technical view
When an AJP request exceeds the listener’s max-header-size, Undertow closes the backend TCP connection without an AJP response. mod_proxy_cluster then marks the JBoss EAP worker as erroneous and stops forwarding requests. Repetition can deny service. The supplied affected inventory identifies specific JBoss EAP 7.1 and 7.3 EUS package builds on RHEL 7.
Likely exposure
Exposure requires an affected JBoss EAP deployment using an AJP listener with httpd mod_cluster or mod_proxy_cluster, where untrusted oversized requests can reach that path. Internet-facing proxies increase concern, but internal services may also be exposed through reachable intermediary systems. The bundle does not establish whether AJP is enabled by default.
Exploitation context
The behavior is remotely triggerable, requires no privileges or user interaction, and is described as low complexity. Repeated malformed requests could remove workers from service. CVE is not identified as CISA KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.
Researcher notes
The narrative describes denial of service, but the supplied CVSS vector encodes confidentiality impact as high and availability impact as none. That inconsistency should be checked against current vendor scoring before relying on component metrics. The package list appears advisory-specific and should not be generalized beyond the named JBoss EAP EUS releases and builds.
Mitigation direction
- Apply the applicable Red Hat security update identified in vendor advisories.
- Confirm update eligibility for the deployed JBoss EAP EUS release and RHEL package set.
- Restrict untrusted access to AJP listeners and cluster-proxy paths where operationally feasible.
- Review current Red Hat guidance before using configuration changes as compensating controls.
Validation and detection
- Inventory JBoss EAP 7.1 and 7.3 EUS deployments and installed package versions.
- Identify AJP listeners and their max-header-size settings.
- Verify whether httpd mod_cluster or mod_proxy_cluster forwards traffic to affected backends.
- Confirm applicable Red Hat errata packages are installed across every cluster node.
- Review proxy and backend logs for worker-error transitions following closed AJP connections.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-5379 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6redhatVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2025:9582CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9583CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-5379CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2242099CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- RHSA-2023:4509CVE reference, CVE · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.