Red Hat Security AdvisoryRHSA-2026:70229
Red Hat JBoss Enterprise Application Platform 8.1.8 security update
Released 2026-09-22 · Red Hat rating Important · View on Red Hat →
Fixes 35 records
Priority HIGH 77
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00463 · Published 2026-08-04 · Partial fix · 2.18.8, 2.21.4 +1 CWE-770
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00665 · Published 2026-07-20 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority HIGH 70
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01066 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 52
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01468 · Published 2026-09-10 · Partial fix CWE-306
Priority MEDIUM 48
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00566 · Published 2026-09-10 · Partial fix CWE-306
Priority MEDIUM 45
Netty is a network application framework for development of protocol servers and clients.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-07-21 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority MEDIUM 45
Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00787 · Published 2026-04-15 · Partial fix · 1.80.2, 1.81.1 +1 CWE-400
Priority MEDIUM 44
In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00493 · Published 2026-08-03 · Partial fix · 1.85, 2.73.12 +3 CWE-789
Priority MEDIUM 43
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509Tr…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00155 · Published 2026-08-22 · Partial fix · 4.2.16.Final, 4.1.137.Final CWE-297
Priority MEDIUM 43
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00533 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-611
Priority MEDIUM 42
A flaw was found in JBoss marshalling.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.0084 · Published 2026-08-11 · Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-502
Priority MEDIUM 41
EAP's Artemis deserialization configuration permits deserialization by default.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.007 · Published 2026-09-07 · Partial fix · 2.40.0.redhat-00024, 2.40.0-8.redhat_00024.1.el10eap +98 CWE-502
Priority MEDIUM 41
A flaw was found in Wildfly.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00888 · Published 2026-08-11 · Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-789
Priority MEDIUM 41
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01017 · Published 2026-08-11 · Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-120
Priority MEDIUM 41
A flaw was found in EAP's jboss-remoting.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00888 · Published 2026-08-11 · Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-190
Priority MEDIUM 41
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01096 · Published 2026-08-27 · Partial fix · 2.3.26.SP3-redhat-00001, 2.40.0-8.redhat_00024.1.el10eap +98 CWE-770
Priority MEDIUM 40
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-08-13 · Partial fix · 4.1.136.Final, 4.2.16.Final CWE-772
Priority MEDIUM 40
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00665 · Published 2026-07-20 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority MEDIUM 40
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01226 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 40
An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00804 · Published 2026-09-10 · Partial fix CWE-306
Priority MEDIUM 40
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00821 · Published 2026-09-10 · Partial fix CWE-306
Priority MEDIUM 40
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00556 · Published 2026-08-05 · Partial fix CWE-22
Priority MEDIUM 40
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00716 · Published 2026-08-11 · Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-770
Priority LOW 39
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes fro…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00751 · Published 2026-08-11 · Fixed in 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-829
Priority LOW 38
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowe…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00697 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority LOW 37
Netty is an asynchronous, event-driven network application framework.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00609 · Published 2026-07-29 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-770
Priority LOW 36
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to con…
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00663 · Published 2026-05-22 · Partial fix · 4.2.1, 4.1.6 +1 CWE-20
Priority LOW 36
A flaw was found in EAP's IIOP.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00663 · Published 2026-08-11 · Partial fix · 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +113 CWE-306
Priority LOW 35
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00482 · Published 2026-08-11 · Fixed in 2.16.0-22.redhat_00057.1.el7eap, 2.3.14-11.SP11_redhat_00001.1.el7eap +109 CWE-295
Priority LOW 32
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01034 · Published 2026-08-11 · Partial fix · 2.3.26.SP3-redhat-00001, 2.40.0-8.redhat_00024.1.el10eap +98 CWE-444
Priority LOW 30
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00443 · Published 2026-06-23 · Partial fix · 2.18.9, 2.21.5 +2 CWE-915
Priority LOW 29
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00346 · Published 2026-07-14 · Partial fix · 2.18.9, 2.21.5 +3 CWE-863
Priority LOW 29
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00408 · Published 2026-07-21 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-284
Priority LOW 28
A flaw was found in the DERDecoder class within wildfly-elytron-asn1.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00715 · Published 2026-09-18 · Partial fix · 2.6.11.Final-redhat-00001, 2.40.0-8.redhat_00024.1.el10eap +98 CWE-770
Priority LOW 19
A flaw was found in EAP's Elytron.
CVSS 3.1MEDIUM 4.2· Network · Low privileges · No interaction · EPSS 0.0028 · Published 2026-09-18 · Partial fix · 2.6.11.Final-redhat-00001, 2.40.0-8.redhat_00024.1.el10eap +98 CWE-290
THREATIST.IORead the docs