https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:31:59.102363+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-wildfly-2022-0866 BIT-wildfly-2022-0866 2026-10-02T20:31:59.190551+00:00

Affected: Bitnami: wildfly

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

 https://cve.radiocsirt.org/vuln/euvd-2026-11290 EUVD-2026-11290 2026-10-02T20:31:59.190645+00:00 EUVD-2026-11290 https://cve.radiocsirt.org/vuln/fkie_cve-2022-0866 fkie_cve-2022-0866 2026-10-02T20:31:59.190663+00:00

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

 https://cve.radiocsirt.org/vuln/ghsa-pjxg-p9c7-7c3v GHSA-pjxg-p9c7-7c3v 2026-10-02T20:31:59.190696+00:00

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

 https://cve.radiocsirt.org/vuln/gsd-2022-0866 gsd-2022-0866 2026-10-02T20:31:59.190718+00:00 gsd-2022-0866 https://cve.radiocsirt.org/vuln/rhsa-2022:4918 RHSA-2022:4918 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7 2026-10-02T20:31:59.190730+00:00

jackson-databind: denial of service via a large depth of nested objects netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way h2: Remote Code Execution in Console netty: control chars in header names may lead to HTTP request smuggling xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr jboss-client: memory leakage in remote client transaction wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled undertow: Double AJP response for 400 from EAP 7 results in CPING failures OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646) h2: Loading of custom classes from remote servers through JNDI xerces-j2: infinite loop when handling specially crafted XML document payloads artemis-commons: Apache ActiveMQ Artemis DoS Moment.js: Path traversal in moment.locale