Red Hat Security Advisory

RHSA-2026:3889

Red Hat JBoss Enterprise Application Platform 8.0.12 security update

Released 2026-03-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 8.0 for RHEL 8 eap8-bouncycastle-1.83.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-jmail-1.83.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pg-1.83.0-1.redhat_00001.1.el8eap +18

Fixes 3 records

TI-2025-11507 CVE-2025-12543 · GHSA-j382-5jj3-vw4j

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

HIGH 76

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01333 Published 2026-01-07 Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20

TI-2025-08973 CVE-2025-9784 · GHSA-95h4-w6j8-2rp8

Undertow: undertow madeyoureset http/2 ddos vulnerability

MEDIUM 43

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02325 Published 2025-09-02 Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770

TI-2024-03624 CVE-2024-3884 · GHSA-6h4f-pj3g-q8fq

Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded

MEDIUM 42

A flaw was found in Undertow that can cause remote denial of service attacks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01457 Published 2025-12-03 Partial fix · 1.4.18-19.SP17_redhat_00001.1.ep7.el7, 7.1.14-4.GA_redhat_00003.1.ep7.el7 +49 CWE-20