Read the docs
Red Hat Security Advisory

RHSA-2025:9582

Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update

Released 2025-06-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 14 records

TI-2021-15209 CVE-2021-37137 · GHSA-9vjp-v76f-g363

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06565 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-15208 CVE-2021-37136 · GHSA-grg4-wf29-r9vv

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05908 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2020-10925 CVE-2020-13949 · GHSA-g2fg-mr77-6vrm

Uncontrolled resource consumption in Apache Thrift

Priority MEDIUM 43

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06861 Published 2021-02-12 Partial fix · 0.14.0 CWE-400
TI-2024-01147 CVE-2024-1233 · GHSA-v4mm-q8fv-r2w5

Eap: wildfly-elytron has a ssrf security issue

Priority MEDIUM 40

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00847 Published 2024-04-09 Partial fix · 32.0.0.Final, 1.15.23.Final-redhat-00001 +57 CWE-918
TI-2022-04106 CVE-2022-4492 · GHSA-pfcc-3g6r-8rg8

Server-side request forgery in undertow

Priority MEDIUM 40

The undertow client is not checking the server identity presented by the server certificate in https connections.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00596 Published 2023-02-23 Partial fix · 2.3.5.Final, 2.2.24.Final CWE-918
TI-2020-15656 CVE-2020-25638 · GHSA-j8jw-g6fq-mp7h

SQL injection in hibernate-core

Priority MEDIUM 40

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.02929 Published 2020-12-02 Partial fix · 5.4.24.Final, 5.3.20.Final CWE-89
TI-2020-15661 CVE-2020-25644 · GHSA-hxj4-885f-grgp

Memory leak in wildfly-openssl

Priority LOW 37

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02365 Published 2020-10-06 Partial fix · 1.1.3.Final CWE-401
TI-2020-08639 CVE-2020-10740 · GHSA-vrmw-2xhq-hrmp

Deserialization of untrusted data in [UNKNOWN] wildfly

Priority LOW 37

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.02067 Published 2020-06-22 Partial fix · 20.0.0.Final CWE-502
TI-2020-16867 CVE-2020-27782 · GHSA-rhcw-wjcm-9h6g

Uncontrolled resource consumption in Undertow

Priority LOW 36

A flaw was found in the Undertow AJP connector.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01375 Published 2021-02-23 Partial fix · 2.1.5, 2.0.33 CWE-400
TI-2022-02902 CVE-2022-3143 · GHSA-jmj6-p2j9-68cp

Observable discrepancy in Red Hat Wildfly-elytron

Priority LOW 35

wildfly-elytron: possible timing attacks via use of unsafe comparator.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.006 Published 2023-01-11 Fixed in 1.15.15, 1.15.15.Final +1 CWE-203