CVE-2025-2251

A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.

• CWE-502

• https://access.redhat.com/errata/RHSA-2025:10452
• https://access.redhat.com/errata/RHSA-2025:10453
• https://access.redhat.com/errata/RHSA-2025:10459
• https://access.redhat.com/errata/RHSA-2025:10924
• https://access.redhat.com/errata/RHSA-2025:10925
• https://access.redhat.com/errata/RHSA-2025:10926
• https://access.redhat.com/errata/RHSA-2025:10931
• https://access.redhat.com/security/cve/CVE-2025-2251
• https://bugzilla.redhat.com/show_bug.cgi?id=2351678
• https://github.com/wildfly/wildfly/pull/18872
• https://github.com/wildfly/wildfly/releases/tag/36.0.0.Final
• https://issues.redhat.com/browse/WFLY-20550

Published

Apr 7, 2025

Last Modified

Jun 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22504Unrestricted Upload of File with Dangerous Type vulnerabilit…10
• CVE-2025-22505Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2025-22506Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-22507Improper Neutralization of Special Elements used in an SQL C…7.6
• CVE-2025-22508Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-22509Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-22510Deserialization of Untrusted Data vulnerability in kkarpiesz…7.2
• CVE-2025-22511Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-22512Missing Authorization vulnerability in BoldGrid Help Scout h…4.3
• CVE-2025-22513Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-22514Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-22515Improper Neutralization of Input During Web Page Generation …6.5