Red Hat Jboss Enterprise Application Platform
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Red Hat Jboss Enterprise Application Platform.
Recent Red Hat Jboss Enterprise Application Platform Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:70421 | (RHSA-2026:70421) Important: Red Hat JBoss Enterprise Application Platform 8.1.8 XP 6.0.6.GA release | September 22, 2026 |
| RHSA-2026:70277 | (RHSA-2026:70277) Important: Red Hat JBoss Enterprise Application Platform 8.1.8 security update | September 22, 2026 |
| RHSA-2026:70230 | (RHSA-2026:70230) Important: Red Hat JBoss Enterprise Application Platform 8.1.8 security update | September 22, 2026 |
| RHSA-2026:67604 | (RHSA-2026:67604) Important: Red Hat JBoss Enterprise Application Platform 7.4.25 security update | September 15, 2026 |
| RHSA-2026:67603 | (RHSA-2026:67603) Important: Red Hat JBoss Enterprise Application Platform 7.4.25 security update | September 15, 2026 |
| RHSA-2026:53806 | (RHSA-2026:53806) Important: Red Hat JBoss Enterprise Application Platform 7.4.25 security update | August 11, 2026 |
| RHSA-2026:50085 | (RHSA-2026:50085) Important: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release | August 4, 2026 |
| RHSA-2026:49701 | (RHSA-2026:49701) Important: Red Hat JBoss Enterprise Application Platform 8.1.7 security update | August 3, 2026 |
| RHSA-2026:42098 | (RHSA-2026:42098) Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 XP 6.0.5.GA release | July 20, 2026 |
| RHSA-2026:36345 | (RHSA-2026:36345) Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 security update | July 7, 2026 |
By the Year
In 2026 there have been 169 vulnerabilities in Red Hat Jboss Enterprise Application Platform with an average score of 7.4 out of ten. Last year, in 2025 Jboss Enterprise Application Platform had 13 security vulnerabilities published. That is, 156 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.92.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 169 | 7.42 |
| 2025 | 13 | 6.50 |
| 2024 | 35 | 6.64 |
| 2023 | 11 | 6.59 |
| 2022 | 10 | 6.64 |
| 2021 | 11 | 6.43 |
| 2020 | 20 | 6.44 |
| 2019 | 20 | 7.58 |
| 2018 | 7 | 7.50 |
It may take a day or so for new Jboss Enterprise Application Platform vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Jboss Enterprise Application Platform Security Vulnerabilities
Netty HTTP/1 Decoder Request Smuggling via Malformed Transfer-Encoding
CVE-2026-93562
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty netty-codec-http HTTP Smuggling via Chunk-Size Post-Digit Whitespace
CVE-2026-93574
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
HTTP Request Smuggling
Netty HTTP/2 Header Field Injection Vulnerability (CVE-2026-93579)
CVE-2026-93579
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty Transfer-Encoding Field Split Bypass Enables Request Smuggling
CVE-2026-93573
6.5 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
HTTP Request Smuggling
Red Hat: HTTP/2/3 EXT CONNECT Downgrade in Apache HTTPd
CVE-2026-93568
7.5 - High
- September 18, 2026
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
Improper Input Validation
Netty netty-codec-smtp SMTP cmd-name not CRLF-validated Vulnerability
CVE-2026-93576
7.5 - High
- September 18, 2026
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.
CRLF Injection
EAP Elytron Token-Realm OAuth2 Introspection URL Encoding Flaw
CVE-2026-85511
4.2 - Medium
- September 18, 2026
A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.
Authentication Bypass by Spoofing
Netty HTTP/1HTTP/2 Host Header Conflict Allows Unauthorized Access
CVE-2026-93569
8.2 - High
- September 18, 2026
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
HTTP Request Smuggling
Netty HTTP/2 CONNECT Host Header Exploit Bypass Tunnel Allow-List
CVE-2026-93567
7.5 - High
- September 18, 2026
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
Improper Input Validation
Netty HTTP Request Smuggling via Chunk-Size Line Bypass
CVE-2026-93566
6.5 - Medium
- September 18, 2026
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
WildFly Elytron ASN1 DERDecoder DoS via Excessive Memory Allocation
CVE-2026-10832
5.9 - Medium
- September 18, 2026
A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.
Allocation of Resources Without Limits or Throttling
Netty RtspDecoder Method-Token Smuggling via RTSP Request
CVE-2026-93565
7.5 - High
- September 18, 2026
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty HAProxy PROXY-v2 RefCnt Leak: Remote DoS
CVE-2026-93564
7.5 - High
- September 18, 2026
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty WebSocketServerExtensionHandler DoS via HTTP/1.1 Pipelining Queue Overflow
CVE-2026-93558
7.5 - High
- September 18, 2026
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty STOMP codec int truncation can cause DoS
CVE-2026-93560
7.5 - High
- September 18, 2026
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty HpackEncoder DoS via oversized SETTINGS MAX_HEADER_TABLE_SIZE
CVE-2026-93492
5.3 - Medium
- September 18, 2026
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty HttpServerCodec DoS via HTTP/1.1 pipelining (before 4.2)
CVE-2026-93491
7.5 - High
- September 18, 2026
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
Allocation of Resources Without Limits or Throttling
Netty SpdySessionHandler Unbounded Streams DoS
CVE-2026-93488
7.5 - High
- September 18, 2026
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
Allocation of Resources Without Limits or Throttling
MemEx DoS via Unbounded Multi-line Response in SmtpResponseDecoder (Apache MINA)
CVE-2026-93563
7.5 - High
- September 18, 2026
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Redisson Java Client Resource Exhaustion via Nested RESP Arrays
CVE-2026-93572
7.5 - High
- September 18, 2026
A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.
Allocation of Resources Without Limits or Throttling
Netty MQTT Decoder DoS via Property Length Exploit
CVE-2026-93575
7.5 - High
- September 18, 2026
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
RedHat Memcached Binary Codec Signed/Unsigned Type Mismatch Desynchronizes Frame
CVE-2026-93561
6.5 - Medium
- September 18, 2026
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Netty StompSubframeDecoder Memory Leak DoS via Missing Null Terminator
CVE-2026-93494
7.5 - High
- September 18, 2026
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
RESTEasy CorsFilter CORS Misconfig Enables Credentialed CrossOrigin Access
CVE-2026-89058
7.4 - High
- September 18, 2026
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
Permissive Cross-domain Policy with Untrusted Domains
RESTEasy IIOImageProv Unbounded Image Dimension DoS
CVE-2026-89059
7.5 - High
- September 18, 2026
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Data Amplification
Red Hat SmallRye JWT Remote Path Traversal - AwsAlbKeyResolver
CVE-2026-81829
5.3 - Medium
- September 17, 2026
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
Directory traversal
Red Hat EAP Artemis deserialization allows all classes by default
CVE-2026-86404
8.8 - High
- September 07, 2026
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
Marshaling, Unmarshaling
XXE in RESTEasy SourceProvider Enables Remote File Read
CVE-2026-17615
7.5 - High
- August 31, 2026
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
XXE
Undertow WebSocket Config Overflow Allows Memory Exhaustion Remote DOS
CVE-2026-81624
7.5 - High
- August 31, 2026
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.
Allocation of Resources Without Limits or Throttling
Undertow WebSocket DoS via PerMessageDeflate Buffer Doubling
CVE-2026-5680
7.5 - High
- August 27, 2026
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.
Allocation of Resources Without Limits or Throttling
WildFly Elytron Unicode Normalization Weakens Password Hashing
CVE-2026-19611
7.4 - High
- August 20, 2026
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
Improper Handling of Alternate Encoding
mod_cluster AdvertiseListener NullPointerException via UDP Multicast
CVE-2026-76166
4.3 - Medium
- August 19, 2026
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
NULL Pointer Dereference
Encoding Truncation in Undertow Response Header Writes
CVE-2026-19879
5.3 - Medium
- August 14, 2026
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
Incorrect Conversion between Numeric Types
Undertow ChunkReader State Overlap Allows Chunked Request Bypass
CVE-2026-14180
5.3 - Medium
- August 11, 2026
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
HTTP Request Smuggling
Wildfly OOM via CSIv2Util GSS Token Length Field Unchecked
CVE-2026-15567
7.5 - High
- August 11, 2026
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
Stack Exhaustion
Undertow @ServerEndpoint WebSocket OOM DoS
CVE-2026-15565
7.5 - High
- August 11, 2026
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.
Classic Buffer Overflow
JBoss EAP IIOP NS Auth Bypass: Unauthenticated Bind Hijacks JNDI
CVE-2026-15563
7.4 - High
- August 11, 2026
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
Missing Authentication for Critical Function
Red Hat JBoss EAP jboss-remoting OOM DoS via Upgrade Handshake
CVE-2026-15562
7.5 - High
- August 11, 2026
A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.
Integer Overflow or Wraparound
JBoss EAP Undertow Chunked-Transfer OOM DoS via HTTP1.1
CVE-2026-15561
7.5 - High
- August 11, 2026
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.
Allocation of Resources Without Limits or Throttling
EAP JDKBridge Unchecked Remote Code Exec via Attacker-supplied CDR Codebase
CVE-2026-15560
8.1 - High
- August 11, 2026
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
Inclusion of Functionality from Untrusted Control Sphere
Picketlink SP Signature Validation Flaw: Forged SAML Response Vulnerability
CVE-2026-15556
8.1 - High
- August 11, 2026
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
Improper Verification of Cryptographic Signature
CVE-2026-15555: JBoss Marshaller RCE via Infinispan deserialization
CVE-2026-15555
8.8 - High
- August 11, 2026
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering enabling RCE via deserialization gadget chains on every cluster node.
Marshaling, Unmarshaling
Undertow AJP Listener Bypass CLIENT-CERT Auth via Forged X.509 Cert
CVE-2026-15554
7.4 - High
- August 11, 2026
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
Improper Certificate Validation
Unsolicited SAML Response Auth Flaw in Picketlink
CVE-2026-10579
9.8 - Critical
- August 11, 2026
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
Improper Verification of Cryptographic Signature
WildFly Core Remote Authenticated Deployment via Malicious Archive Upload
CVE-2026-24330
6.5 - Medium
- August 11, 2026
A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.
Unrestricted File Upload
WildFly Core: Malicious Inet Address Payload Crashes Config (DoS)
CVE-2026-24329
4.9 - Medium
- August 11, 2026
A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.
aka Blind XPath Injection
Path Traversal in WildFly Domain Mode via Slave-DC Protocol
CVE-2026-17614
4.4 - Medium
- August 04, 2026
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.
Directory traversal
Keycloak JWT grant bypass for disabled users due to missing validation
CVE-2026-1609
8.1 - High
- July 16, 2026
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the users disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.
Authorization
CVE-2025-12799: XSS in Jastow (and Undertow) via unescaped URL chars
CVE-2025-12799
6.5 - Medium
- July 07, 2026
A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.
XSS
Jackson-Databind PTV Array Type Allowlist Bypass 2.10.0-2.18.8, 2.21.4, 3.1.4
CVE-2026-54513
8.1 - High
- June 23, 2026
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Denylist / Deny List
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Jboss Enterprise Application Platform or by Red Hat? Click the Watch button to subscribe.
