Read the docs
TI-2025-17143 Aliases CVE-2025-23368GHSA-qhp6-6p8p-2rqh

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

Priority LOW 39CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-307.

Summary

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00885 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.wildfly.core:wildfly-elytron-integration (Maven): 32.0.0.Beta3, 31.0.3.FinalRed Hat: 4 advisoriesRed Hat: 4 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—wildfly-coreall versions—No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—7.3.18-3.GA_redhat_00001.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 8.1.6.GA—27.1.9.Final-redhat-00002Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8—8.1.6-5.GA_redhat_00007.1.el8eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9—8.1.6-5.GA_redhat_00007.1.el9eapPatch availableCNA
Red HatRed Hat Build of Keycloak——Not affectedCNA
Red HatRed Hat Data Grid 8——No fix listedCNA
Red HatRed Hat Fuse 7——Not affectedCNA
Red HatRed Hat Fuse 7——No fix listedCNA
Red HatRed Hat Integration Camel K 1——Not affectedCNA
Red HatRed Hat JBoss Data Grid 7——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform 7——No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——Not affectedCNA
Red HatRed Hat Process Automation 7——Not affectedCNA
Red HatRed Hat Process Automation 7——No fix listedCNA
Red HatRed Hat Single Sign-On 7——Not affectedCNA
Red HatRed Hat Single Sign-On 7——No fix listedCNA
—org.wildfly.core:wildfly-elytron-integration (Maven)32.0.0.Beta1 to before 32.0.0.Beta332.0.0.Beta3Patch availableGHSA-qhp6-6p8p-2rqh
—org.wildfly.core:wildfly-elytron-integration (Maven)before 31.0.3.Final31.0.3.FinalPatch availableGHSA-qhp6-6p8p-2rqh
  • wildfly-core Vendor— Affected all versions Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.3.18-3.GA_redhat_00001.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA VendorRed Hat Affected — Fixed in 27.1.9.Final-redhat-00002 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 8.1.6-5.GA_redhat_00007.1.el8eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 8.1.6-5.GA_redhat_00007.1.el9eap Patch available CNA
  • Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • org.wildfly.core:wildfly-elytron-integration (Maven) Vendor— Affected 32.0.0.Beta1 to before 32.0.0.Beta3 Fixed in 32.0.0.Beta3 Patch available GHSA-qhp6-6p8p-2rqh
  • org.wildfly.core:wildfly-elytron-integration (Maven) Vendor— Affected before 31.0.3.Final Fixed in 31.0.3.Final Patch available GHSA-qhp6-6p8p-2rqh

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*before 31.0.3VulnerableRed Hat
cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:* Versions before 31.0.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-qhp6-6p8p-2rqh org.wildfly.core:wildfly-elytron-integration (Maven) Fixed in 32.0.0.Beta3 Advisory →
  • Fix · GHSA-qhp6-6p8p-2rqh org.wildfly.core:wildfly-elytron-integration (Maven) Fixed in 31.0.3.Final Advisory →

Red Hat 4 advisories

  • RHSA-2026:33371 Released 2026-06-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.18 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
  • RHSA-2026:18054 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el8eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el8eap +47
  • RHSA-2026:18055 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-cli-2.40.0-6.redhat_00012.1.el9eap, eap8-activemq-artemis-commons-2.40.0-6.redhat_00012.1.el9eap +47
Show 1 more Red Hat advisories
  • RHSA-2026:18059 Released 2026-05-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6.GA io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, org.apache.activemq.artemis-server-2.40.0.redhat-00012.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:18054
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:18055
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:33371
Red Hat JBoss Enterprise Application Platform 8.1.6.GAFixed RHSA-2026:18059
Not affected: 11 products
  • Red Hat Build of Keycloak
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss EAP 8.1 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • Red Hat JBoss Enterprise Application Platform 8.1.6.GA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-23368
  2. 2026-10-03 Alias added: GHSA-qhp6-6p8p-2rqh
  3. 2026-10-15 Affected versions changed · CNA
  4. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  5. 2026-10-19 Fix available: org.wildfly.core/[email protected] · CNA
  6. 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6.GA · Red Hat

References

Exploit 1

Advisory 7

Other 6

  • TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2021-11905 Improper authentication in Red Hat DataGrid and Infinispan CVSS 3.1CRITICAL 9.8
  • TI-2026-22645 Undertow: undertow: request smuggling via inconsistent header parsing CVSS 3.1CRITICAL 9.1
  • TI-2026-22646 Undertow: undertow: request smuggling via malformed http request headers CVSS 3.1CRITICAL 9.1
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences