CVE catalog

CVE-2022-0084

jboss-xnio: CVE-2022-0084

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.58% · Oct 25, 2026

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjboss-xniosid3.8.10-1fixed
Debianjboss-xnioforky3.8.10-1fixed
Debianjboss-xniotrixie3.8.10-1fixed
Debianjboss-xniobookworm3.8.8-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjboss-xniosourcesid3.8.7-2not yet assignedNot reported[1013280]
Debianjboss-xniosourceforky3.8.7-2not yet assignedNot reported[1013280]
Debianjboss-xniosourcetrixie3.8.7-2not yet assignedNot reported[1013280]
Debianjboss-xniosourcebookworm3.8.7-2not yet assignedNot reported[1013280]

[Debian bug #1013280]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjboss-xnio-java]Fixed

    Source package: [jboss-xnio]

    Details (2)

    • 3.8.8-1 · all · bookworm

      Fixed · Fixed: 3.8.7-2

      dsa · jboss-xnio · debian · bookworm

    • 3.8.8-1 · all · bookworm

      Fixed · Fixed: 3.8.7-2

      dsa · jboss-xnio · debian · bookworm

  • [libjboss-xnio-java-doc]Fixed

    Source package: [jboss-xnio]

    Details (2)

    • 3.8.8-1 · all · bookworm

      Fixed · Fixed: 3.8.7-2

      dsa · jboss-xnio · debian · bookworm

    • 3.8.8-1 · all · bookworm

      Fixed · Fixed: 3.8.7-2

      dsa · jboss-xnio · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]