Red Hat Security AdvisoryRHSA-2026:4915
Red Hat JBoss Enterprise Application Platform 7.4.24 security update
Released 2026-03-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el7eap +42
Fixes 9 records
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority MEDIUM 63
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git p…
CVSS 4.0MEDIUM 6.8· Network · Low privileges · User interaction · EPSS 0.00844 · Published 2025-05-21 · Partial fix · 7.2.1.202505142326-r, 7.1.1.202505221757-r +4 CWE-611
Priority MEDIUM 51
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01072 · Published 2025-08-08 · Partial fix · 4.1.3, 4.0.9 +1 CWE-20
Priority MEDIUM 49
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.02772 · Published 2024-09-19 · Partial fix · 28.2, 3.25.5 +2 CWE-400
Priority MEDIUM 45
jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00772 · Published 2025-06-25 · Partial fix · 2.15.0 CWE-121
Priority MEDIUM 44
Netty is an asynchronous, event-driven network application framework.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.01125 · Published 2025-08-13 · Partial fix · 4.1.124.Final, 4.2.4.Final +1 CWE-770
Priority MEDIUM 43
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2025-09-02 · Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
Priority MEDIUM 42
A flaw was found in Undertow that can cause remote denial of service attacks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01457 · Published 2025-12-03 · Partial fix · 1.4.18-19.SP17_redhat_00001.1.ep7.el7, 7.1.14-4.GA_redhat_00003.1.ep7.el7 +49 CWE-20
Priority MEDIUM 40
A flaw was found in Hibernate.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.01032 · Published 2026-01-23 · Partial fix · 5.1.17-4.Final_redhat_00005.1.ep7.el7, 7.1.14-4.GA_redhat_00003.1.ep7.el7 +13 CWE-89
THREATIST.IORead the docs