Red Hat Security Advisory

RHSA-2025:17299

Red Hat JBoss Enterprise Application Platform 8.1.0 security update

Released 2025-10-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 8.1.0 io.netty.netty-codec-4.1.127.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.127.Final-redhat-00001.jar, org.apache.cxf.cxf-rt-transports-jms-4.0.9.redhat-00002.jar +1

Fixes 4 records

TI-2024-19434 CVE-2024-29371 · GHSA-3677-xxcr-wjqv

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by…

HIGH 72

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00257 Published 2025-12-17 Partial fix · 0.9.6 CWE-1259

TI-2025-31053 CVE-2025-48913 · GHSA-g4px-6qhm-hqjm

Apache CXF: Untrusted JMS configuration can lead to RCE

MEDIUM 51

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01072 Published 2025-08-08 Partial fix · 4.1.3, 4.0.9 +1 CWE-20

TI-2025-34845 CVE-2025-55163 · GHSA-prj3-ccx8-p6x4

Netty MadeYouReset HTTP/2 DDoS Vulnerability

MEDIUM 44

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.01125 Published 2025-08-13 Partial fix · 4.1.124.Final, 4.2.4.Final +1 CWE-770

TI-2025-35899 CVE-2025-58056 · GHSA-fghv-69vj-qj49

Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

LOW 16

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.0071 Published 2025-09-03 Partial fix · 4.2.5.Final, 4.1.125.Final CWE-444