Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.wildfly.core:wildfly-elytron-integration

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    Wildfly Elytron integration susceptible to brute force attacks via CLI

    CVE-2025-23368 · GHSA-qhp6-6p8p-2rqh

    Affected
    • Maven org.wildfly.core:wildfly-elytron-integration >= 32.0.0.Beta1, < 32.0.0.Beta3; < 31.0.3.Final
    Fixed in
    32.0.0.Beta331.0.3.Final· Vendor fix available
    Issue
    Impact A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. Patches The default behaviour has been changed in WildFly Core 31.0.3.Final, and 32.0.0.Beta3 - the first version is used by WildFly 39.0.1.Final and the second will be included in WildFly 40. Workarounds No direct workaround. Monitoring network traffic / blocking suspicious traffic may help. References https://www.cve.org/CVERecord?id=CVE-2025-23368 https://issues.redhat.com/browse/WFCORE-7192 Acknowledgements We would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue.

    Recommended action: Upgrade to 32.0.0.Beta3 or 31.0.3.Final by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →