Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-5685

CVE-2023-5685: XNIO denial of service vulnerability

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-5685
GHSA ID
GHSA-7f88-5hhx-67m2
EPSS Score
0.59532%
CWE
CWE-400
Published
3/22/2024
Updated
11/26/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jboss.xnio:xnio-apimaven<= 3.8.13.Final3.8.14.Final

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from recursive calls in NotifierState's notification methods (notifyDone/notifyFailed/notifyCancelled) that traverse a chain of nested states. The original implementation (pre-patch) used direct recursion via 'next.notifyX()' calls, which could exhaust the stack when the chain is large. The fix introduced iterative traversal via NestedState class. The vulnerable functions are explicitly shown in the commit diff modifying NotifierState's notification methods before the loop-based approach was implemented.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *oun* in XNIO. T** XNIO Noti*i*rSt*t* t**t **n **us* * St**k Ov*r*low *x**ption w**n t** ***in o* noti*i*r st*t*s ***om*s pro*l*m*ti**lly l*r** **n l*** to un*ontroll** r*sour** m*n***m*nt *n* * possi*l* **ni*l o* s*rvi** (*oS). V*rsion *.

Reasoning

T** vuln*r**ility st*ms *rom r**ursiv* **lls in Noti*i*rSt*t*'s noti*i**tion m*t*o*s (noti*y*on*/noti*y**il**/noti*y**n**ll**) t**t tr*v*rs* * ***in o* n*st** st*t*s. T** ori*in*l impl*m*nt*tion (pr*-p*t**) us** *ir**t r**ursion vi* 'n*xt.noti*yX()'
CVE-2023-5685: XNIO NotifierState Stack DoS | Miggo