Red Hat Security Advisory

RHSA-2026:25126

Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Released 2026-06-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 8.1.6 io.undertow.undertow-core-2.3.24.SP2-redhat-00001.jar, org.jboss.activemq.artemis.integration.artemis-wildfly-integration-2.0.3.Final-redhat-00001.jar

Fixes 4 records

TI-2026-22645 CVE-2026-28368 · GHSA-8v4x-mgvp-p658

Undertow: undertow: request smuggling via inconsistent header parsing

MEDIUM 43

A flaw was found in Undertow.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00732 Published 2026-03-27 Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444

TI-2026-22646 CVE-2026-28369 · GHSA-vqqj-9cmv-hx43

Undertow: undertow: request smuggling via malformed http request headers

MEDIUM 42

A flaw was found in Undertow.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00689 Published 2026-03-27 Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444

TI-2026-22644 CVE-2026-28367 · GHSA-3gv6-g396-9v4r

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

MEDIUM 42

A flaw was found in Undertow.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00719 Published 2026-03-27 Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444

TI-2026-01291 CVE-2026-1605 · GHSA-xxh7-fcf3-rj7f

Uncontrolled resource consumption in Eclipse Jetty

MEDIUM 40

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compr…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00741 Published 2026-03-05 Partial fix · 12.1.6, 12.0.32 CWE-400