Red Hat Security AdvisoryRHSA-2026:33371
Red Hat JBoss Enterprise Application Platform 7.3.18 security update
Released 2026-06-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
Fixes 11 records
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00539 · Published 2026-02-11 · Partial fix · 6.14.0, 8.17.2 +1 CWE-1333
Priority HIGH 72
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00257 · Published 2025-12-17 · Partial fix · 0.9.6 CWE-1259
Priority HIGH 70
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00384 · Published 2026-01-15 · Partial fix · 4.5.24, 5.0.7 CWE-444
Priority HIGH 69
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00608 · Published 2026-01-28 · Partial fix · 7.5.7 CWE-22
Priority MEDIUM 43
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2025-09-02 · Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 39
A flaw was found in Wildfly Elytron integration.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00885 · Published 2025-03-04 · Partial fix · 7.3.18-3.GA_redhat_00001.1.el7eap, 27.1.9.Final-redhat-00002 +4 CWE-307
Priority LOW 37
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.
CVSS 4.0HIGH 8.5· Network · Low privileges · User interaction · EPSS 0.00383 · Published 2025-12-01 · Partial fix · 21.0.2, 20.3.15 +1 CWE-79
Priority LOW 37
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02194 · Published 2025-01-21 · Partial fix · 3.5.10, 3.6.5 +1 CWE-400
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
THREATIST.IORead the docs