Read the docs
Red Hat Security Advisory

RHSA-2025:4226

Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update

Released 2025-04-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 17 records

TI-2022-19041 CVE-2022-40152 · GHSA-3f7h-mf4q-vrm4

Stack Buffer Overflow in Woodstox

Priority HIGH 66

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.18215 Published 2022-09-16 Partial fix · 6.4.0, 5.4.0 CWE-121
TI-2022-08598 CVE-2022-24785 · GHSA-8hfj-j24r-96c4

Path Traversal in Moment.js

Priority MEDIUM 54

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.1384 Published 2022-04-04 Partial fix · 2.29.2 CWE-22
TI-2022-09231 CVE-2022-25647 · GHSA-4jrv-ppp4-jm57

Deserialization of untrusted data in com.google.code.gson:gson

Priority MEDIUM 50

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.1223 Published 2022-05-01 Partial fix · 2.8.9 CWE-502
TI-2021-17647 CVE-2021-40690 · GHSA-j8wc-gxx9-82hx

Bypass of the secureValidation property

Priority MEDIUM 49

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference e…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07441 Published 2021-09-19 Partial fix · 2.2.3,2.1.7, 2.2.3 +1 CWE-200
TI-2022-09423 CVE-2022-25857 · GHSA-3mc7-4q67-w48m

Denial of service (DoS) in org.yaml:snakeyaml

Priority LOW 38

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02932 Published 2022-08-30 Partial fix · 1.31 CWE-776
TI-2022-07892 CVE-2022-23913 · GHSA-pr38-qpxm-g88x

Apache ActiveMQ Artemis DoS

Priority LOW 38

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0274 Published 2022-02-04 Partial fix · 2.20.0, 2.19.1 CWE-770
TI-2022-19038 CVE-2022-40149 · GHSA-56h3-78gp-v83r

Stack Buffer Overflow in Jettison

Priority LOW 36

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01677 Published 2022-09-16 Partial fix · 1.5.1 CWE-121
TI-2022-01201 CVE-2022-1319 · GHSA-5r46-q4x7-6fx6

A flaw was found in Undertow.

Priority LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01696 Published 2022-08-31 Partial fix CWE-252
TI-2022-00035 CVE-2022-0084 · GHSA-76fg-mhrg-fmmg

Resource allocation without limits in xnio

Priority LOW 36

A flaw was found in XNIO, specifically in the notifyReadClosed method.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01583 Published 2022-08-26 Partial fix CWE-770
TI-2021-02790 CVE-2021-3859 · GHSA-339q-62wm-c39w

Exposure of resource to wrong sphere in undertow

Priority LOW 36

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01736 Published 2022-08-26 Partial fix · 2.2.15 CWE-214
TI-2022-01901 CVE-2022-2053 · GHSA-95rf-557x-44g5

Uncontrolled resource consumption in Undertow

Priority LOW 35

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/prox…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01093 Published 2022-08-05 Partial fix · 2.2.19.Final, 2.3.0.Alpha2 CWE-400