Red Hat Security AdvisoryRHSA-2025:16668
Red Hat JBoss Enterprise Application Platform 7.1.12 on RHEL 7 security update
Released 2025-09-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.ep7.el7, eap7-hibernate-validator-5.3.6-1.SP1_redhat_00001.1.ep7.el7, eap7-hibernate-validator-cdi-5.3.6-1.SP1_redhat_00001.1.ep7.el7 +7
Fixes 5 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 81
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.88755 · Published 2024-04-04 · Partial fix CWE-770
Priority HIGH 73
Improper Access Control vulnerability in Apache Commons.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02018 · Published 2025-05-28 · Partial fix · 1.11.0, 2.0.0-M2 CWE-284
Priority MEDIUM 48
An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00671 · Published 2024-11-04 · Partial fix CWE-22
Priority LOW 36
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01465 · Published 2020-06-10 · Partial fix · 2.1.1.Final CWE-770
THREATIST.IORead the docs