Read the docs
Red Hat Security Advisory

RHSA-2025:9583

Red Hat JBoss Enterprise Application Platform 7.3.14 Security update

Released 2025-06-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 14 records

TI-2021-15209 CVE-2021-37137 · GHSA-9vjp-v76f-g363

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06565 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2021-15208 CVE-2021-37136 · GHSA-grg4-wf29-r9vv

Uncontrolled resource consumption in Netty

Priority MEDIUM 48

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05908 Published 2021-10-19 Partial fix · 4.1.68Final, 4.1.68.Final CWE-400
TI-2024-01147 CVE-2024-1233 · GHSA-v4mm-q8fv-r2w5

Eap: wildfly-elytron has a ssrf security issue

Priority MEDIUM 40

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00847 Published 2024-04-09 Partial fix · 32.0.0.Final, 1.15.23.Final-redhat-00001 +57 CWE-918
TI-2022-04106 CVE-2022-4492 · GHSA-pfcc-3g6r-8rg8

Server-side request forgery in undertow

Priority MEDIUM 40

The undertow client is not checking the server identity presented by the server certificate in https connections.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00596 Published 2023-02-23 Partial fix · 2.3.5.Final, 2.2.24.Final CWE-918
TI-2022-01201 CVE-2022-1319 · GHSA-5r46-q4x7-6fx6

A flaw was found in Undertow.

Priority LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01696 Published 2022-08-31 Partial fix CWE-252
TI-2022-02902 CVE-2022-3143 · GHSA-jmj6-p2j9-68cp

Observable discrepancy in Red Hat Wildfly-elytron

Priority LOW 35

wildfly-elytron: possible timing attacks via use of unsafe comparator.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.006 Published 2023-01-11 Fixed in 1.15.15, 1.15.15.Final +1 CWE-203
TI-2022-01901 CVE-2022-2053 · GHSA-95rf-557x-44g5

Uncontrolled resource consumption in Undertow

Priority LOW 35

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/prox…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01093 Published 2022-08-05 Partial fix · 2.2.19.Final, 2.3.0.Alpha2 CWE-400