# CVE-2024-4029: WildFly Denial of Service in management interface

Source: https://junglewise.ai/threats/cve-2024-4029-wildfly-denial-of-service-in-management-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-02. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2024-4029 · Severity: medium · CVSS 4.1 · Published 2024-05-02

WildFly, a popular Java application server, contains a flaw in its management interface that fails to limit the number of simultaneous connections. An attacker with local access to the server could exhaust system resources by opening too many connections, potentially causing the entire application server to crash or become unresponsive. This would disrupt business operations and any services hosted on the affected server.

Technologies: [Red Hat WildFly](https://junglewise.ai/threats/technologies/wildfly). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2024-4029 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-4029 being exploited in the wild.

**How severe is CVE-2024-4029?** Medium severity, with a CVSS score of 4.1, published 2 May 2024.

**Which products and versions are affected?** org.wildfly:wildfly-domain-http (Maven) <= 24.0.0.Final, ECOSYSTEM:introduced=0,last_affected=24.0.0.Final; Red Hat WildFly <= 24.0.0.Final.

**Is there a fix for CVE-2024-4029?** A patch was published on 2024-10-14: Red Hat released security updates for JBoss EAP 7.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-4029 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2024-4029?** Check whether you run org.wildfly:wildfly-domain-http (Maven) or Red Hat WildFly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability (CWE-770) exists in the WildFly management interface (specifically within the wildfly-domain-http component). The interface lacks a mechanism to configure or enforce a maximum number of concurrent socket connections. An attacker with local access and high privileges can exploit this by opening numerous connections until the system's 'nofile' (number of open files) limit is reached. This results in a Denial of Service (DoS) condition for the WildFly server. While the management interface is typically not exposed to the network by default, the vulnerability poses a risk in environments where local users are untrusted or the interface has been manually exposed. Patches have been released by Red Hat for JBoss EAP versions.

## Affected products

- WildFly WildFly <= 24.0.0.Final
- Red Hat JBoss Enterprise Application Platform 7.4, 8.0

## Identifiers

- CVE-2024-4029
- GHSA-x7g6-rwhc-g7mj

## Timeline

- 2024-05-02: disclosed: Vulnerability reported and CVE-2024-4029 assigned
- 2024-05-02: advisory: GitHub Advisory GHSA-x7g6-rwhc-g7mj published
- 2024-10-14: patched: Red Hat released security updates for JBoss EAP 7.4
- 2024-11-04: patched: Red Hat released security updates for JBoss EAP 8.0

## References

- [https://access.redhat.com/security/cve/CVE-2024-4029](https://access.redhat.com/security/cve/CVE-2024-4029)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2278615](https://bugzilla.redhat.com/show_bug.cgi?id=2278615)
- [https://access.redhat.com/errata/RHSA-2024:8075](https://access.redhat.com/errata/RHSA-2024:8075)
- [https://access.redhat.com/errata/RHSA-2024:8076](https://access.redhat.com/errata/RHSA-2024:8076)
- [https://access.redhat.com/errata/RHSA-2024:8077](https://access.redhat.com/errata/RHSA-2024:8077)

## Related threats

- [Wildfly IIOP listener pre-authentication deserialization](https://junglewise.ai/threats/cve-2026-15564-wildfly-s-iiop-listener-may-permit-deserialization-of-input)
- [WildFly authentication bypass in IIOP EJB CSIv2](https://junglewise.ai/threats/cve-2026-114488-a-flaw-was-found-in-wildfly-a-remote-attacker-can-bypass)
- [WildFly path traversal in take-snapshot operation](https://junglewise.ai/threats/cve-2026-84823-a-flaw-was-found-in-wildfly-a-user-with-the-monitor-role-which-is)
- [WildFly and JBoss EAP path traversal in ContentRepositoryImpl](https://junglewise.ai/threats/cve-2026-85634-a-flaw-was-found-in-the-contentrepositoryimpl-copyexplodedcontent)
- [Undertow WebSocket resource exhaustion via unbounded buffers](https://junglewise.ai/threats/cve-2026-81624-undertow-websocket-resource-exhaustion-via-unbounded-buffers)