Description
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.
Remediation
References
Related Vulnerabilities
Squid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-10003)
MODX Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2017-7324)
WordPress Plugin Monarch Social Sharing Security Bypass (1.2.6)