CVE & CISA-KEV Catalog

CVE-2020-13949

HIGHEPSS 93th pctl

7.5

CVSS v3

Description

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

CWE-400Resource Exhaustion

How to fix

Remediation Available

thriftDebian

Fixed in:0.16.0-3CVE-2020-13949

Fixed in:0.16.0-3CVE-2020-13949

Fixed in:0.16.0-3CVE-2020-13949

eap7-glassfish-elRocky

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-elRed Hat / RHEL

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-el-implRocky

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-el-implRed Hat / RHEL

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-hibernateRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernateRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-coreRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-coreRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-entitymanagerRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-entitymanagerRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-enversRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-enversRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-infinispanRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-infinispanRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-java8Red Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-java8Rocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-jackson-databindRed Hat / RHEL

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-jackson-databindRocky

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-jboss-ejb-clientRed Hat / RHEL

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-jboss-ejb-clientRocky

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-nettyRed Hat / RHEL

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-nettyRocky

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-netty-allRocky

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-netty-allRed Hat / RHEL

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-undertowRed Hat / RHEL

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-undertowRocky

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildflyRed Hat / RHEL

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildflyRocky

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-elytronRocky

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-elytronRed Hat / RHEL

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-client-commonRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-client-commonRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-ejb-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-ejb-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-naming-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-naming-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-transaction-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-transaction-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-modulesRocky

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-modulesRed Hat / RHEL

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-naming-clientRed Hat / RHEL

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-naming-clientRocky

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-opensslRed Hat / RHEL

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-opensslRocky

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-javaRocky

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-javaRed Hat / RHEL

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linuxRocky

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linuxRed Hat / RHEL

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linux-debuginfoRocky

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linux-debuginfoRed Hat / RHEL

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit Intelligence

6.78%probability of exploitation in 30 days

93rdpercentile

High risk: more likely to be exploited than 93% of all known CVEs.

References

Related Vulnerabilities

Other CWE-400 (Resource Exhaustion) vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2023-44487	High	7.5	100%	KEV	Fix
CVE-2021-44228	Critical	10.0	100%	KEV + Ransom	Fix
CVE-2011-3192	High	7.8	99%	-	Fix
CVE-2019-11478	Medium	5.3	95%	-	Fix
CVE-2024-25617	Medium	5.3	89%	-	Fix
CVE-2018-1000115	High	7.5	89%	-	Fix

Embed a live status badge for CVE-2020-13949

Markdown

[![CVE-2020-13949](https://tridentstack.com/cve/badge/CVE-2020-13949.svg)](https://tridentstack.com/cve/CVE-2020-13949)

HTML

<a href="https://tridentstack.com/cve/CVE-2020-13949"><img src="https://tridentstack.com/cve/badge/CVE-2020-13949.svg" alt="CVE-2020-13949"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.