RHSA-2026:95887

A flaw was found in Netty's WebSocketServerExtensionHandler.

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMetho…

A flaw was found in Netty's HTTP/1 decoder.

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Crede…

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place.

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value.

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate.

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI.

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted…

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read.

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard.

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split.

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery).

A flaw was found in Netty's HttpServerCodec.

A flaw was found in Netty.

Netty is an asynchronous, event-driven network application framework.

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments.

A flaw was found in Netty RtspDecoder.

js-yaml is a JavaScript YAML parser and dumper.

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities.

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers.

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option.

A flaw was found in RESTEasy's SourceProvider.

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes fro…

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes fro…

A flaw was found in Netty's HTTP/1.1 decoder.

A flaw was found in Netty.

A flaw was found in WildFly Elytron.

A flaw was found in Wildfly.

Improper certificate validation in Apache MINA SSHD (server-side).

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed.

Netty is an asynchronous, event-driven network application framework.

A flaw was found in Netty's `netty-codec-http` component.

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key.

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations.

A path traversal flaw was found in WildFly's domain mode implementation.