Read the docs
Red Hat Security Advisory

RHSA-2026:4924

Red Hat JBoss Enterprise Application Platform 7.4.24 security update

Released 2026-03-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2025-11507 CVE-2025-12543 · GHSA-j382-5jj3-vw4j

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Priority HIGH 76

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01333 Published 2026-01-07 Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
TI-2025-04438 CVE-2025-4949 · GHSA-vrpq-qp53-qv56

XXE vulnerability in Eclipse JGit

Priority MEDIUM 63

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git p…

CVSS 4.0MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00844 Published 2025-05-21 Partial fix · 7.2.1.202505142326-r, 7.1.1.202505221757-r +4 CWE-611
TI-2025-31053 CVE-2025-48913 · GHSA-g4px-6qhm-hqjm

Apache CXF: Untrusted JMS configuration can lead to RCE

Priority MEDIUM 51

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01072 Published 2025-08-08 Partial fix · 4.1.3, 4.0.9 +1 CWE-20
TI-2025-34845 CVE-2025-55163 · GHSA-prj3-ccx8-p6x4

Netty MadeYouReset HTTP/2 DDoS Vulnerability

Priority MEDIUM 44

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.01125 Published 2025-08-13 Partial fix · 4.1.124.Final, 4.2.4.Final +1 CWE-770
TI-2025-08973 CVE-2025-9784 · GHSA-95h4-w6j8-2rp8

Undertow: undertow madeyoureset http/2 ddos vulnerability

Priority MEDIUM 43

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02325 Published 2025-09-02 Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770