Red Hat Security AdvisoryRHSA-2026:92059
Red Hat JBoss Enterprise Application Platform 8.1.9 security update
Released 2026-10-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 8.1 for RHEL 10 eap8-apache-cxf-4.1.8-1.redhat_00001.1.el10eap, eap8-apache-cxf-rt-4.1.8-1.redhat_00001.1.el10eap, eap8-apache-cxf-services-4.1.8-1.redhat_00001.1.el10eap +32
Fixes 5 records
Priority MEDIUM 47
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00279 · Published 2026-08-06 · Partial fix · 4.2.3, 4.1.8 +1 CWE-345
Priority MEDIUM 40
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00652 · Published 2026-08-06 · Partial fix · 4.2.3, 4.1.8 +1 CWE-611
Priority MEDIUM 40
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00664 · Published 2026-08-06 · Partial fix · 4.2.3, 4.1.8 +1 CWE-400
Priority MEDIUM 40
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-08-06 · Partial fix · 4.2.3, 4.1.8 +1 CWE-400
Priority LOW 33
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00324 · Published 2026-08-17 · Partial fix · 4.1.137.Final, 4.2.17.Final CWE-524
THREATIST.IORead the docs