CVE-2016-2094

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-0595.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0596.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0597.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0598.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0599.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1308465Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0595.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0596.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0597.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0598.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-0599.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1308465Vendor Advisory

Timeline

Published: May 6, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-20975.3Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read ar CVE-2016-20987.3Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rub CVE-2016-20999.8Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to h CVE-2016-21005.4Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveragi CVE-2016-21025.3HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network.CVE-2016-21036.1Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via CVE-2016-21046.1Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via CVE-2016-21057.5Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote atta CVE-2016-21067.5Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote at CVE-2016-21075.9The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding chec CVE-2016-21089.8The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denia CVE-2016-21097.5The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h al