Intel

AIKIDO-2026-10061

jboss-logmanager is vulnerable to Uncontrolled Recursion

Uncontrolled Recursion Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.

43

Medium Risk

This Affects:

JAVAjboss-logmanager
3.0.3.Final - 3.1.2.Final
Fixed in 3.2.0.Final

TL;DR

Affected versions of this package are vulnerable to a reentrancy issue in asynchronous logging methods that could lead to a stack overflow. This vulnerability arises when asynchronous logging methods lack proper locking checks, allowing reentrant calls that can recursively exhaust the call stack. An attacker might exploit this by crafting log events that trigger recursive logging, causing a stack overflow and resulting in a denial of service.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

jboss-logmanager is vulnerable to Uncontrolled Recursion in versions 3.0.3.Final - 3.1.2.Final.

How to fix this

Upgrade the org.jboss.logmanager:jboss-logmanager library to a patch version.