Live › vulnerability › CVE-2017-12149
Go to dashboardJBoss Application Server shipped with Red Hat Enterprise Application Platform 5.2 deserializes crafted serialized data without checks. An unauthenticated attacker who sends such data can execute arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Red Hat JBoss Application Server | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the Red Hat update for JBoss Application Server per vendor instructions (CISA required action); the specific patched version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
This page as .md · .json · in your agent: get_signal("CVE-2017-12149")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.