{"id":"CVE-2024-8447","state":"PUBLISHED","title":"Narayana: deadlock via multiple join requests sent to lra coordinator","description":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service.","publishedAt":"2025-01-02T20:19:29.671Z","updatedAt":"2026-09-07T14:22:43.170Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["narayana","Red Hat Red Hat JBoss EAP XP 5.0 Update 2.0","Red Hat Red Hat JBoss Enterprise Application Platform 8","Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","Red Hat Red Hat JBoss Data Grid 7","Red Hat Red Hat JBoss Enterprise Application Platform 7","Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack"],"affected":[{"packageName":"narayana","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.1.0.Final","versionType":"semver"}],"collectionURL":"https://github.com/jbosstm/narayana/"},{"vendor":"Red Hat","product":"Red Hat JBoss EAP XP 5.0 Update 2.0","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_xp:5.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-eap-product-conf-parent","defaultStatus":"affected","versions":[{"version":"0:800.6.1-1.GA_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-netty-transport-native-epoll","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-slf4j","defaultStatus":"affected","versions":[{"version":"0:2.0.16-2.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly","defaultStatus":"affected","versions":[{"version":"0:8.0.6-15.GA_redhat_00009.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-eap-product-conf-parent","defaultStatus":"affected","versions":[{"version":"0:800.6.1-1.GA_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-netty-transport-native-epoll","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-slf4j","defaultStatus":"affected","versions":[{"version":"0:2.0.16-2.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-wildfly","defaultStatus":"affected","versions":[{"version":"0:8.0.6-15.GA_redhat_00009.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Data Grid 7","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_data_grid:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":["https://access.redhat.com/errata/RHSA-2025:3357","https://access.redhat.com/errata/RHSA-2025:3358","https://access.redhat.com/errata/RHSA-2025:7620","https://access.redhat.com/security/cve/CVE-2024-8447","https://bugzilla.redhat.com/show_bug.cgi?id=2335206","https://github.com/jbosstm/narayana/pull/2293"],"weaknesses":["CWE-833"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8447.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-8447","state":"PUBLISHED","datePublished":"2025-01-02T20:19:29.671Z","dateUpdated":"2026-09-07T14:22:43.170Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-09-05T01:54:51.271Z"},"containers":{"cna":{"title":"Narayana: deadlock via multiple join requests sent to lra coordinator","descriptions":[{"lang":"en","value":"A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service."}],"affected":[{"packageName":"narayana","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.1.0.Final","versionType":"semver"}],"collectionURL":"https://github.com/jbosstm/narayana/"},{"vendor":"Red Hat","product":"Red Hat JBoss EAP XP 5.0 Update 2.0","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_xp:5.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-eap-product-conf-parent","defaultStatus":"affected","versions":[{"version":"0:800.6.1-1.GA_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-netty-transport-native-epoll","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-slf4j","defaultStatus":"affected","versions":[{"version":"0:2.0.16-2.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly","defaultStatus":"affected","versions":[{"version":"0:8.0.6-15.GA_redhat_00009.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-eap-product-conf-parent","defaultStatus":"affected","versions":[{"version":"0:800.6.1-1.GA_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-netty-transport-native-epoll","defaultStatus":"affected","versions":[{"version":"0:4.1.119-1.Final_redhat_00002.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-slf4j","defaultStatus":"affected","versions":[{"version":"0:2.0.16-2.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","packageName":"eap8-wildfly","defaultStatus":"affected","versions":[{"version":"0:8.0.6-15.GA_redhat_00009.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Data Grid 7","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_data_grid:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jboss.narayana-narayana-all","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:3357","name":"RHSA-2025:3357","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3358","name":"RHSA-2025:3358","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7620","name":"RHSA-2025:7620","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8447","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2335206","name":"RHBZ#2335206","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/jbosstm/narayana/pull/2293"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-833","description":"Deadlock","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-07T14:22:43.170Z"},"datePublic":"2024-09-30T00:00:00.000Z","x_redhatCweChain":"CWE-833: Deadlock","timeline":[{"lang":"en","time":"2025-01-01T22:41:50.788Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-09-30T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-02T20:41:25.038566Z","id":"CVE-2024-8447","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-02T20:41:33.544Z"}}]}}}