CVE-2023-5685

23

FAUCET Score

CVE-2023-5685 is a high-severity denial-of-service vulnerability in XNIO, stemming from a stack overflow exception caused by an excessively large chain of notifier states. This flaw allows an unauthenticated attacker to remotely trigger resource exhaustion. While the CVSS score is 7.5, there is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
Red Hat	Red Hat Build Of Apache Camel - HawtIO 4	All Versions ImpactedCNA affecteddefault affected
Red Hat	Red Hat Integration Camel K 1	All Versions ImpactedCNA affecteddefault affected
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 On RHEL 7	Range not provided by sourceCNA affecteddefault affected
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 For RHEL 8	Range not provided by sourceCNA affecteddefault affected
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 For RHEL 9	Range not provided by sourceCNA affecteddefault affected

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

3.48%

Probability of exploitation in next 30 days

EPSS Percentile

87.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0348 is in the 78th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (30)

mavenpatch availablevia ghsa

Product: org.jboss.xnio:xnio-apiFixed in: 3.8.14.Final

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4.4.0 for Spring BootFixed in: xnio

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-xnio-base-0:3.8.11-1.SP1_redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-xnio-base-0:3.8.11-1.SP1_redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.8.11-1.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap

redhatno patchvia redhat_api

Product: Red Hat Process Automation 7Fixed in: xnio

redhatend of lifevia redhat_api

Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: xnio

redhatend of lifevia redhat_api

Product: Red Hat Integration Camel K 1Fixed in: xnio

Vendor Advisories (2)

mavenGHSA-7f88-5hhx-67m2high

XNIO denial of service vulnerability

redhatCVE-2023-5685Important

xnio: StackOverflowException when the chain of notifier states becomes problematically big

References

access.redhat.com / errata/RHSA-2023:7637

access.redhat.com / errata/RHSA-2023:7638

access.redhat.com / errata/RHSA-2023:7639

access.redhat.com / errata/RHSA-2023:7641

access.redhat.com / errata/RHSA-2024:10207

access.redhat.com / errata/RHSA-2024:10208

access.redhat.com / errata/RHSA-2024:2707

access.redhat.com / security/cve/CVE-2023-5685

bugzilla.redhat.com / show_bug.cgi