Red Hat Security Advisory

RHSA-2026:53644

Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate

Released 2026-08-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47

Fixes 41 records

TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

HIGH 81

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0063 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3

Netty: HttpClientCodec response desynchronization

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01006 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-20

TI-2026-48269 CVE-2026-68494 · GHSA-r7wm-3cxj-wff9

Resource allocation without limits in FasterXML jackson-core

HIGH 77

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00463 Published 2026-08-04 Partial fix · 2.18.8, 2.21.4 +1 CWE-770

TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-30865 CVE-2026-42585 · GHSA-38f8-5428-x5cv

Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00267 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-39358 CVE-2026-54512 · GHSA-j3rv-43j4-c7qm

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

HIGH 70

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01066 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-30017 CVE-2026-41417 · GHSA-v8h7-rr48-vmmv

Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

MEDIUM 63

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00318 Published 2026-05-06 Partial fix · 4.1.133.Final, 4.2.13.Final CWE-444

TI-2026-21857 CVE-2026-27446 · GHSA-fw88-pf9m-p947

Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

MEDIUM 61

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.114 Published 2026-03-04 Partial fix · 2.52.0 CWE-306

TI-2026-09097 CVE-2026-10579 · GHSA-wcq4-9xxp-5px6

Picketlink-federation: auth bypass in picketlink saml unsolicited-response

MEDIUM 49

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any r…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00425 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +9 CWE-347

TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

MEDIUM 48

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.01065 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-113

TI-2026-04906 CVE-2026-5598 · GHSA-p93r-85wp-75v3

Non-constant time comparisons risk private key leakage in FrodoKEM.

MEDIUM 48

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00899 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-385

TI-2026-35500 CVE-2026-48059 · GHSA-h2qv-fj59-j46j

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

MEDIUM 45

Netty is a network application framework for development of protocol servers and clients.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-401

TI-2026-35451 CVE-2026-48006 · GHSA-6jv9-x5w9-2ccm

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

MEDIUM 45

Netty is a network application framework for development of protocol servers and clients.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0074 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-401

TI-2026-03020 CVE-2026-3505 · GHSA-cj8j-37rh-8475

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

MEDIUM 45

Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00787 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-400

TI-2026-35195 CVE-2026-47691 · GHSA-5pvg-856g-cp85

Netty has Insufficient Bailiwick Validation for NS Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00372 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33416 CVE-2026-45674 · GHSA-676x-f7gg-47vc

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00292 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-65177 CVE-2026-101292 · GHSA-226w-4p8p-xh2w

Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

MEDIUM 42

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy().

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00523 Published 2026-09-28 Fixed in 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +9 CWE-470

TI-2026-13093 CVE-2026-15555 · GHSA-8qrr-8665-54fg

Deserialization of untrusted data in Red Hat JBoss Enterprise Application Platform 7.4.25

MEDIUM 42

A flaw was found in JBoss marshalling.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.0084 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-502

TI-2025-13517 CVE-2025-14813 · GHSA-574f-3g2m-x479

GOSTCTR implementation unable to process more than 255 blocks correctly

MEDIUM 42

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0CRITICAL 9.3 Local No auth No interaction EPSS 0.0032 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-327

TI-2026-33205 CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

MEDIUM 41

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00921 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770

TI-2026-13103 CVE-2026-15567 · GHSA-h33j-vrhg-4q7j

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

MEDIUM 41

A flaw was found in Wildfly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00888 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-789

TI-2026-13102 CVE-2026-15565 · GHSA-356w-cx4r-75hv

Buffer overflow in Red Hat JBoss Enterprise Application Platform 7.4.25

MEDIUM 41

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01017 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-120

TI-2026-13100 CVE-2026-15562 · GHSA-r89v-33gc-39f6

Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service

MEDIUM 41

A flaw was found in EAP's jboss-remoting.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00888 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-190

TI-2026-35485 CVE-2026-48043 · GHSA-c2gf-v879-257j

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00753 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-34243 CVE-2026-46581 · GHSA-wrxx-w58g-3gqp

Path traversal in Eclipse Mojarra

MEDIUM 40

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00556 Published 2026-08-05 Partial fix CWE-22

TI-2026-34060 CVE-2026-46340 · GHSA-5xrh-qmmq-w6ch

Netty: SCTP reassembly nests buffers without bound

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00606 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770

TI-2026-32768 CVE-2026-44893 · GHSA-cc37-9q2j-3hfv

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00617 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-703

TI-2026-13099 CVE-2026-15561 · GHSA-fhmg-q5fc-2m8v

Undertow-core: oom via missing limits in chunked trailer in eap's undertow

MEDIUM 40

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00716 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-770

TI-2026-36837 CVE-2026-50011 · GHSA-5w86-c3rq-vjj7

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-36836 CVE-2026-50010 · GHSA-c653-97m9-rcg9

Netty's wrapping plain trust manager silently disables hostname verification

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-347

TI-2026-32765 CVE-2026-44890 · GHSA-6ghj-frrj-jjj3

Netty has Unbounded Direct Memory Consumption in its RedisDecoder

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-32227 CVE-2026-44250 · GHSA-3244-j874-rhc2

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-32226 CVE-2026-44249 · GHSA-3qp7-7mw8-wx86

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00987 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-284

TI-2026-13098 CVE-2026-15560 · GHSA-4238-grjh-g4xm

Openjdk-orb: unauthed class loading via iiop in eap

LOW 39

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes fro…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00751 Published 2026-08-11 Fixed in 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-829

TI-2026-13094 CVE-2026-15556 · GHSA-vw9v-mpfh-qwg3

Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

LOW 37

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00301 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +9 CWE-347

TI-2026-13101 CVE-2026-15563 · GHSA-259j-555g-mwrr

Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos

LOW 36

A flaw was found in EAP's IIOP.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00663 Published 2026-08-11 Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +113 CWE-306

TI-2026-36952 CVE-2026-50193 · GHSA-3wrr-7qpf-2prh

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

LOW 35

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00616 Published 2026-06-23 Partial fix · 2.14.0 CWE-400

TI-2026-13092 CVE-2026-15554 · GHSA-f478-cwfc-jqh3

Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery

LOW 35

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00482 Published 2026-08-11 Fixed in 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-295

TI-2026-04899 CVE-2026-5588 · GHSA-wg6q-6289-32hp

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

LOW 35

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00777 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +4 CWE-327

TI-2026-00434 CVE-2026-0636 · GHSA-c3fc-8qff-9hwx

LDAP Injection Vulnerability in LDAPStoreHelper.java

LOW 31

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00527 Published 2026-04-15 Partial fix · 1.80.2, 1.81.1 +1 CWE-90