CVE-2017-12174
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
It was found that when Artemis and HornetQ before version 2.4.0 are configured with UDP discovery and JGroups discovery, a huge byte array is created when receiving an unexpected multicast message. This may result in heap memory exhaustion, full GC, or OutOfMemoryError.
Risk Assessment
The organization may experience performance issues, and in extreme cases, application failure due to lack of available memory.
Recommendation
It is recommended to upgrade to version 2.4.0 or later to eliminate this vulnerability and to monitor memory usage in the system.
Original NVD description (English source)
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.