What is CVE-2018-1041?

CVE-2018-1041 is a high-severity vulnerability in Jboss Jboss-Remoting, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2018-02-15.

How severe is CVE-2018-1041?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2018-1041 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Jboss Jboss-Remoting

CVE-2018-1041

A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer. An attacker could use this flaw to cause denial of service via high CPU caused by an infinite loop.

Published 2018-02-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.155 (96.8th percentile), scored 2026-10-20.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.155 · newest: 0.155 · change: 0.000

Affected products

Jboss Jboss-Remoting — versions 3.3.10
Red Hat, Inc. Jboss-Remoting — versions since 3.3.10
Red Hat Jboss Enterprise Application Platform — versions 6.0.0, 6.4.0
Red Hat Linux — versions 5.0, 6.0, 7.0

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

www.exploit-db.com/exploits/44099/ (Exploit, VDB Entry, Third Party Advisory, exploit)
access.redhat.com/errata/RHSA-2018:0269 (vendor-advisory, Vendor Advisory)
access.redhat.com/errata/RHSA-2018:0270 (vendor-advisory, Vendor Advisory)
access.redhat.com/errata/RHSA-2018:0271 (vendor-advisory, Vendor Advisory)
access.redhat.com/errata/RHSA-2018:0268 (vendor-advisory, Vendor Advisory)
access.redhat.com/errata/RHSA-2018:0275 (vendor-advisory, Vendor Advisory)
www.securitytracker.com/id/1040323 (VDB Entry, Third Party Advisory, vdb-entry)
bugzilla.redhat.com/show_bug.cgi (Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2018-1041?: CVE-2018-1041 is a high-severity vulnerability in Jboss Jboss-Remoting, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2018-02-15.
How severe is CVE-2018-1041?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2018-1041 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.