Xnio: stackoverflowexception when the chain of notifier states becomes problematically big

Description

A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

Scores

EPSS (exploitation in 30 days)

3.5% · top 11% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-400: Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs

Affected products

• Red Hat · Red Hat build of Apache Camel 4.4.0 for Spring Boot

  All versions: unaffected

• Red Hat · Red Hat JBoss Enterprise Application Platform

  • unaffected 3.8.11.SP1-redhat-00001 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:3.1.16-3.SP1_redhat_00001.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:1.7.6-2.redhat_00003.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:1.68.0-1.redhat_00005.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:1.4.197-2.redhat_00005.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:2.0.15-1.Final_redhat_00001.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:3.5.10-1.Final_redhat_00001.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:7.1.8-2.GA_redhat_00002.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

  • unaffected 0:2.7.1-26.redhat_00015.1.ep7.el7 – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:3.4.10-1.SP1_redhat_00001.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:1.7.6-8.redhat_00003.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:1.4.197-3.redhat_00004.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:2.0.1-4.Final_redhat_00001.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:2.0.15-1.Final_redhat_00001.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:1.7.2-12.Final_redhat_00013.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:3.7.13-1.Final_redhat_00001.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:1.2.2-2.Final_redhat_00002.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:7.3.11-4.GA_redhat_00002.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:2.3.3-2.redhat_00001.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:2.7.1-38.redhat_00015.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

  • unaffected 0:2.2.3-2.redhat_00001.1.el7eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

  • unaffected 0:3.8.11-1.SP1_redhat_00001.1.el8eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

  • unaffected 0:3.8.11-1.SP1_redhat_00001.1.el9eap – < *

• Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

  • unaffected 0:3.8.11-1.SP1_redhat_00001.1.el7eap – < *

• Red Hat · Red Hat build of Apache Camel for Spring Boot 3

  All versions: unaffected

• Red Hat · Red Hat build of Apache Camel - HawtIO 4

  All versions: affected

• Red Hat · Red Hat Build of Keycloak

  All versions: unaffected

• Red Hat · Red Hat Data Grid 8

  All versions: unaffected

• Red Hat · Red Hat Integration Camel K 1

  All versions: affected

• Red Hat · Red Hat JBoss Data Grid 7

  All versions: unknown

• Red Hat · Red Hat JBoss Enterprise Application Platform 8

  All versions: unaffected

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: unaffected

• Red Hat · Red Hat JBoss Fuse Service Works 6

  All versions: unknown

• Red Hat · Red Hat Process Automation 7

  All versions: affected

• Red Hat · Red Hat Single Sign-On 7

  All versions: unaffected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.jboss.xnio:xnio-apiGHSA-7f88-5hhx-67m2 (opens in a new tab)

What to do

Workaround: There is currently no mitigation available for this vulnerability. Please keep the packages up-to-date as the updates become available.

References (9)

• RHSA-2023:7637 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2023:7638 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2023:7639 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2023:7641 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2024:10207 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:10208 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2024:2707 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• https://access.redhat.com/security/cve/CVE-2023-5685 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
• RHBZ#2241822 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-7f88-5hhx-67m2 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-5685](https://trackcve.app/badge/CVE-2023-5685.svg)](https://trackcve.app/cve/CVE-2023-5685)

Record last updated 4 Nov 2026, 21:06 UTC.