RHSA-2026:70277

Vulnerability from csaf_redhat - Published: 2026-09-22 15:35 - Updated: 2026-10-09 16:28
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update
Severity
Important
Notes
Topic: A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section
Details: Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.8 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494) * netty-codec-http2: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745) * netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [eap-8.1.z] (CVE-2026-62243) * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length [eap-8.1.z] (CVE-2026-59649) * jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [eap-8.1.z] (CVE-2026-54515) * jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [eap-8.1.z] (CVE-2026-59889) * netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names [eap-8.1.z] (CVE-2026-73508) * jboss-eap.1-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494) * jboss-eap-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494) * bcprov-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion [eap-8.1.z] (CVE-2026-3505) * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays [eap-8.1.z] (CVE-2026-69152) * netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [eap-8.1.z] (CVE-2026-59899) * netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [eap-8.1.z] (CVE-2026-56746) * netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745) * netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [eap-8.1.z] (CVE-2026-55831) * netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [eap-8.1.z] (CVE-2026-55833) * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [eap-8.1.z] (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [eap-8.1.z] (CVE-2026-54512) * undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap [eap-8.1.z] (CVE-2026-14180) * artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0 [eap-8.1.z] (CVE-2026-49363) * undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method [eap-8.1.z] (CVE-2026-15565) * wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener [eap-8.1.z] (CVE-2026-15567) * cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-50632) * cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening [eap-8.1.z] (CVE-2026-49875) * wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload [eap-8.1.z] (CVE-2026-10832) * cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-44417) * wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2 [eap-8.1.z] (CVE-2026-85511) * jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include [eap-8.1.z] (CVE-2026-46581) * wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS [eap-8.1.z] (CVE-2026-15563) * jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service [eap-8.1.z] (CVE-2026-15562) * undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow [eap-8.1.z] (CVE-2026-15561) * openjdk-orb: unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-15560) * artemis-server: Apache Artemis — session hijack via missing authentication [eap-8.1.z] (CVE-2026-57967) * wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller [eap-8.1.z] (CVE-2026-15555) * undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery [eap-8.1.z] (CVE-2026-15554) * jgroups: artemis cluster password leak via jgroups spoof [eap-8.1.z] (CVE-2026-49364) * artemis-server: artemis core protocol permits unauthed queue creation [eap-8.1.z] (CVE-2026-49362) * artemis-server: artemis messaging handlers in Red Hat EAP permit deserialization by default [eap-8.1.z] (CVE-2026-86404) * undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing [eap-8.1.z] (CVE-2026-5680) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-3505

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-5680

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-10832

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Moderate
CVE-2026-14180

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Moderate
CVE-2026-15554

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-15561

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-15562

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-15563

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-306 - Missing Authentication for Critical Function
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-44417

A flaw was found in Apache CXF. Untrusted users, if allowed to configure Java Message Service (JMS) for Apache CXF, can exploit this vulnerability to achieve remote code execution (RCE). This issue arises from an incomplete fix for a prior security flaw, indicating an alternative path that could lead to code execution.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-15 - External Control of System or Configuration Setting
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-46581

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-49362

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state manipulation.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-306 - Missing Authentication for Critical Function
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-49363

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore(), no credential verification, no subject validation. An unauthenticated attacker can send a single 5-byte packet on the CORE protocol (via :8080 HTTP-upgrade in EAP or :61616 in AMQ Broker) to obtain the broker's nodeID (type-1 UUID embedding MAC address), internal hostname/IP, port numbers, connector configurations, and backup/scale-down group names. In clustered deployments, a persistent ClusterTopologyListener is registered that continuously pushes all topology changes to the unauthenticated client. This contrasts with the federation handler in the same file which was fixed via ARTEMIS-5928 (CVE-2026-27446). The leaked nodeID UUID seed directly enables session-name brute-force for REATTACH_SESSION session hijack.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-306 - Missing Authentication for Critical Function
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Moderate
CVE-2026-49364

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations.

8.0 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-49875

A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band (OOB) external entity resolution, a type of XML External Entity (XXE) vulnerability. A remote attacker could exploit this to disclose sensitive information from the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-611 - Improper Restriction of XML External Entity Reference
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-50632

A flaw was found in Apache CXF. This vulnerability, stemming from an incomplete fix for a previous issue, allows untrusted users who can configure Java Message Service (JMS) for Apache CXF to achieve arbitrary code execution. This could lead to a complete compromise of the affected system.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-54512

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-54513

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-184 - Incomplete List of Disallowed Inputs
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-54515

A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly ignored properties. This could lead to unintended changes in application data, impacting data integrity.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Moderate
CVE-2026-55831

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-55833

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-56745

A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-56746

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-57967

in Apache Artemis, the REATTACH_SESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-306 - Missing Authentication for Critical Function
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-59649

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine (JVM) maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message, leading to excessive memory consumption and a Denial of Service (DoS) condition where the application becomes unresponsive or crashes.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-59889

A flaw was found in jackson-databind. The UnwrappedPropertyHandler.processUnwrapped() method, responsible for handling @JsonUnwrapped properties, replays buffered JSON without properly checking the active view. This allows an attacker to write data to a property annotated with both @JsonView and @JsonUnwrapped even when deserializing under a less-privileged view. This can lead to mass-assignment and privilege escalation, enabling an untrusted caller to modify sensitive data that should be restricted to privileged users.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Moderate
CVE-2026-59899

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-62243

A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-68494

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-69152

A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-73508

A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually leading to a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-290 - Authentication Bypass by Spoofing
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Low
CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Fixed 1 product, the same list as for CVE-2026-3505
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:70277 self
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://access.redhat.com/articles/7137769 external
https://bugzilla.redhat.com/show_bug.cgi?id=2455350 external
https://bugzilla.redhat.com/show_bug.cgi?id=2458638 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477930 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477945 external
https://bugzilla.redhat.com/show_bug.cgi?id=2478013 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480601 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480637 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480638 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480729 external
https://bugzilla.redhat.com/show_bug.cgi?id=2483131 external
https://bugzilla.redhat.com/show_bug.cgi?id=2483133 external
https://bugzilla.redhat.com/show_bug.cgi?id=2483135 external
https://bugzilla.redhat.com/show_bug.cgi?id=2483136 external
https://bugzilla.redhat.com/show_bug.cgi?id=2483138 external
https://bugzilla.redhat.com/show_bug.cgi?id=2483140 external
https://bugzilla.redhat.com/show_bug.cgi?id=2484703 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488304 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488309 external
https://bugzilla.redhat.com/show_bug.cgi?id=2490628 external
https://bugzilla.redhat.com/show_bug.cgi?id=2491620 external
https://bugzilla.redhat.com/show_bug.cgi?id=2492010 external
https://bugzilla.redhat.com/show_bug.cgi?id=2492015 external
https://bugzilla.redhat.com/show_bug.cgi?id=2492016 external
https://bugzilla.redhat.com/show_bug.cgi?id=2492627 external
https://bugzilla.redhat.com/show_bug.cgi?id=2494771 external
https://bugzilla.redhat.com/show_bug.cgi?id=2500653 external
https://bugzilla.redhat.com/show_bug.cgi?id=2503101 external
https://bugzilla.redhat.com/show_bug.cgi?id=2503103 external
https://bugzilla.redhat.com/show_bug.cgi?id=2505422 external
https://bugzilla.redhat.com/show_bug.cgi?id=2505911 external
https://bugzilla.redhat.com/show_bug.cgi?id=2507482 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510195 external
https://bugzilla.redhat.com/show_bug.cgi?id=2510722 external
https://bugzilla.redhat.com/show_bug.cgi?id=2511026 external
https://bugzilla.redhat.com/show_bug.cgi?id=2515377 external
https://bugzilla.redhat.com/show_bug.cgi?id=2521309 external
https://issues.redhat.com/browse/JBEAP-32314 external
https://issues.redhat.com/browse/JBEAP-32869 external
https://issues.redhat.com/browse/JBEAP-33162 external
https://issues.redhat.com/browse/JBEAP-33185 external
https://issues.redhat.com/browse/JBEAP-33236 external
https://issues.redhat.com/browse/JBEAP-33237 external
https://issues.redhat.com/browse/JBEAP-33288 external
https://issues.redhat.com/browse/JBEAP-33363 external
https://issues.redhat.com/browse/JBEAP-33405 external
https://issues.redhat.com/browse/JBEAP-33409 external
https://issues.redhat.com/browse/JBEAP-33413 external
https://issues.redhat.com/browse/JBEAP-33449 external
https://issues.redhat.com/browse/JBEAP-33459 external
https://issues.redhat.com/browse/JBEAP-33501 external
https://issues.redhat.com/browse/JBEAP-33616 external
https://issues.redhat.com/browse/JBEAP-33640 external
https://issues.redhat.com/browse/JBEAP-33683 external
https://issues.redhat.com/browse/JBEAP-33848 external
https://issues.redhat.com/browse/JBEAP-33871 external
https://issues.redhat.com/browse/JBEAP-33904 external
https://issues.redhat.com/browse/JBEAP-33925 external
https://issues.redhat.com/browse/JBEAP-33967 external
https://issues.redhat.com/browse/JBEAP-33968 external
https://issues.redhat.com/browse/JBEAP-33973 external
https://issues.redhat.com/browse/JBEAP-34018 external
https://issues.redhat.com/browse/JBEAP-34095 external
https://issues.redhat.com/browse/JBEAP-34096 external
https://issues.redhat.com/browse/JBEAP-34111 external
https://issues.redhat.com/browse/JBEAP-34161 external
https://issues.redhat.com/browse/JBEAP-34222 external
https://issues.redhat.com/browse/JBEAP-34521 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-3505 self
https://bugzilla.redhat.com/show_bug.cgi?id=2458638 external
https://www.cve.org/CVERecord?id=CVE-2026-3505 external
https://nvd.nist.gov/vuln/detail/CVE-2026-3505 external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9… external
https://access.redhat.com/security/cve/CVE-2026-5680 self
https://bugzilla.redhat.com/show_bug.cgi?id=2455350 external
https://www.cve.org/CVERecord?id=CVE-2026-5680 external
https://nvd.nist.gov/vuln/detail/CVE-2026-5680 external
https://access.redhat.com/security/cve/CVE-2026-10832 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484703 external
https://www.cve.org/CVERecord?id=CVE-2026-10832 external
https://nvd.nist.gov/vuln/detail/CVE-2026-10832 external
https://access.redhat.com/security/cve/CVE-2026-14180 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494771 external
https://www.cve.org/CVERecord?id=CVE-2026-14180 external
https://nvd.nist.gov/vuln/detail/CVE-2026-14180 external
https://access.redhat.com/security/cve/CVE-2026-15554 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480601 external
https://www.cve.org/CVERecord?id=CVE-2026-15554 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15554 external
https://access.redhat.com/security/cve/CVE-2026-15555 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480637 external
https://www.cve.org/CVERecord?id=CVE-2026-15555 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15555 external
https://access.redhat.com/security/cve/CVE-2026-15560 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483131 external
https://www.cve.org/CVERecord?id=CVE-2026-15560 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15560 external
https://access.redhat.com/security/cve/CVE-2026-15561 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483133 external
https://www.cve.org/CVERecord?id=CVE-2026-15561 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15561 external
https://access.redhat.com/security/cve/CVE-2026-15562 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483135 external
https://www.cve.org/CVERecord?id=CVE-2026-15562 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15562 external
https://access.redhat.com/security/cve/CVE-2026-15563 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483138 external
https://www.cve.org/CVERecord?id=CVE-2026-15563 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15563 external
https://access.redhat.com/security/cve/CVE-2026-15565 self
https://bugzilla.redhat.com/show_bug.cgi?id=2490628 external
https://www.cve.org/CVERecord?id=CVE-2026-15565 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15565 external
https://cwe.mitre.org/data/definitions/120.html external
https://access.redhat.com/security/cve/CVE-2026-15567 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491620 external
https://www.cve.org/CVERecord?id=CVE-2026-15567 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15567 external
https://access.redhat.com/security/cve/CVE-2026-44417 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480729 external
https://www.cve.org/CVERecord?id=CVE-2026-44417 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44417 external
https://lists.apache.org/thread/bqg6gjy2cx7rfyqjx… external
https://access.redhat.com/security/cve/CVE-2026-46581 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483136 external
https://www.cve.org/CVERecord?id=CVE-2026-46581 external
https://nvd.nist.gov/vuln/detail/CVE-2026-46581 external
https://access.redhat.com/security/cve/CVE-2026-49362 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477945 external
https://www.cve.org/CVERecord?id=CVE-2026-49362 external
https://nvd.nist.gov/vuln/detail/CVE-2026-49362 external
https://access.redhat.com/security/cve/CVE-2026-49363 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492627 external
https://www.cve.org/CVERecord?id=CVE-2026-49363 external
https://nvd.nist.gov/vuln/detail/CVE-2026-49363 external
https://access.redhat.com/security/cve/CVE-2026-49364 self
https://bugzilla.redhat.com/show_bug.cgi?id=2478013 external
https://www.cve.org/CVERecord?id=CVE-2026-49364 external
https://nvd.nist.gov/vuln/detail/CVE-2026-49364 external
https://access.redhat.com/security/cve/CVE-2026-49875 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488309 external
https://www.cve.org/CVERecord?id=CVE-2026-49875 external
https://nvd.nist.gov/vuln/detail/CVE-2026-49875 external
http://www.openwall.com/lists/oss-security/2026/06/11/2 external
https://lists.apache.org/thread/3kb9w5bg90xcp06fc… external
https://access.redhat.com/security/cve/CVE-2026-50632 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488304 external
https://www.cve.org/CVERecord?id=CVE-2026-50632 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50632 external
https://lists.apache.org/thread/740ghch5z5y675cn2… external
https://access.redhat.com/security/cve/CVE-2026-54512 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492015 external
https://www.cve.org/CVERecord?id=CVE-2026-54512 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54512 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-54513 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492010 external
https://www.cve.org/CVERecord?id=CVE-2026-54513 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54513 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/pull/5984 external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-54515 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492016 external
https://www.cve.org/CVERecord?id=CVE-2026-54515 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54515 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-55831 self
https://bugzilla.redhat.com/show_bug.cgi?id=2503103 external
https://www.cve.org/CVERecord?id=CVE-2026-55831 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55831 external
https://github.com/netty/netty/commit/5b68c61f37a… external
https://github.com/netty/netty/commit/bb2ff68a1fb… external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-55833 self
https://bugzilla.redhat.com/show_bug.cgi?id=2503101 external
https://www.cve.org/CVERecord?id=CVE-2026-55833 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55833 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-56745 self
https://bugzilla.redhat.com/show_bug.cgi?id=2505911 external
https://www.cve.org/CVERecord?id=CVE-2026-56745 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56745 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-56746 self
https://bugzilla.redhat.com/show_bug.cgi?id=2505422 external
https://www.cve.org/CVERecord?id=CVE-2026-56746 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56746 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-57967 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480638 external
https://www.cve.org/CVERecord?id=CVE-2026-57967 external
https://nvd.nist.gov/vuln/detail/CVE-2026-57967 external
https://access.redhat.com/security/cve/CVE-2026-59649 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510195 external
https://www.cve.org/CVERecord?id=CVE-2026-59649 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59649 external
https://github.com/bcgit/bc-java/commit/a43c40dc1… external
https://github.com/bcgit/bc-java/wiki/CVE-2026-59649 external
https://access.redhat.com/security/cve/CVE-2026-59889 self
https://bugzilla.redhat.com/show_bug.cgi?id=2500653 external
https://www.cve.org/CVERecord?id=CVE-2026-59889 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59889 external
https://github.com/FasterXML/jackson-databind/com… external
https://github.com/FasterXML/jackson-databind/iss… external
https://github.com/FasterXML/jackson-databind/pull/6056 external
https://github.com/FasterXML/jackson-databind/sec… external
https://access.redhat.com/security/cve/CVE-2026-59899 self
https://bugzilla.redhat.com/show_bug.cgi?id=2507482 external
https://www.cve.org/CVERecord?id=CVE-2026-59899 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59899 external
https://github.com/netty/netty/security/advisorie… external
https://netty.io/news/2026/07/09/4-1-136-Final.html external
https://access.redhat.com/security/cve/CVE-2026-62243 self
https://bugzilla.redhat.com/show_bug.cgi?id=2521309 external
https://www.cve.org/CVERecord?id=CVE-2026-62243 external
https://nvd.nist.gov/vuln/detail/CVE-2026-62243 external
https://github.com/netty/netty/security/advisorie… external
https://www.vulncheck.com/advisories/netty-throug… external
https://access.redhat.com/security/cve/CVE-2026-68494 self
https://bugzilla.redhat.com/show_bug.cgi?id=2511026 external
https://www.cve.org/CVERecord?id=CVE-2026-68494 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68494 external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/commit/… external
https://github.com/FasterXML/jackson-core/pull/1611 external
https://github.com/FasterXML/jackson-core/securit… external
https://github.com/advisories/GHSA-72hv-8253-57qq external
https://www.cve.org/CVERecord?id=CVE-2026-18401 external
https://access.redhat.com/security/cve/CVE-2026-69152 self
https://bugzilla.redhat.com/show_bug.cgi?id=2510722 external
https://www.cve.org/CVERecord?id=CVE-2026-69152 external
https://nvd.nist.gov/vuln/detail/CVE-2026-69152 external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/c… external
https://github.com/juliangruber/brace-expansion/s… external
https://access.redhat.com/security/cve/CVE-2026-73508 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515377 external
https://www.cve.org/CVERecord?id=CVE-2026-73508 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73508 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-85511 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483140 external
https://www.cve.org/CVERecord?id=CVE-2026-85511 external
https://nvd.nist.gov/vuln/detail/CVE-2026-85511 external
https://access.redhat.com/security/cve/CVE-2026-86404 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477930 external
https://www.cve.org/CVERecord?id=CVE-2026-86404 external
https://nvd.nist.gov/vuln/detail/CVE-2026-86404 external
Acknowledgments
Avishek Sarkar Brian Laub
Gai Tanaka
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss  Enterprise Application Platform 8.1.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494)\n\n* netty-codec-http2: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745)\n\n* netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [eap-8.1.z] (CVE-2026-62243)\n\n* bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length [eap-8.1.z] (CVE-2026-59649)\n\n* jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [eap-8.1.z] (CVE-2026-54515)\n\n* jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [eap-8.1.z] (CVE-2026-59889)\n\n* netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names [eap-8.1.z] (CVE-2026-73508)\n\n* jboss-eap.1-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494)\n\n* jboss-eap-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494)\n\n* bcprov-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion [eap-8.1.z] (CVE-2026-3505)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays [eap-8.1.z] (CVE-2026-69152)\n\n* netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [eap-8.1.z] (CVE-2026-59899)\n\n* netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [eap-8.1.z] (CVE-2026-56746)\n\n* netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745)\n\n* netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [eap-8.1.z] (CVE-2026-55831)\n\n* netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [eap-8.1.z] (CVE-2026-55833)\n\n* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [eap-8.1.z] (CVE-2026-54513)\n\n* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [eap-8.1.z] (CVE-2026-54512)\n\n* undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap [eap-8.1.z] (CVE-2026-14180)\n\n* artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0 [eap-8.1.z] (CVE-2026-49363)\n\n* undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method [eap-8.1.z] (CVE-2026-15565)\n\n* wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener [eap-8.1.z] (CVE-2026-15567)\n\n* cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-50632)\n\n* cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening [eap-8.1.z] (CVE-2026-49875)\n\n* wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload [eap-8.1.z] (CVE-2026-10832)\n\n* cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-44417)\n\n* wildfly-elytron-realm-token: parameter injection in EAP\u0027s elytron oauth2 [eap-8.1.z] (CVE-2026-85511)\n\n* jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include [eap-8.1.z] (CVE-2026-46581)\n\n* wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS [eap-8.1.z] (CVE-2026-15563)\n\n* jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service [eap-8.1.z] (CVE-2026-15562)\n\n* undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow [eap-8.1.z] (CVE-2026-15561)\n\n* openjdk-orb: unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-15560)\n\n* artemis-server: Apache Artemis \u2014 session hijack via missing authentication [eap-8.1.z] (CVE-2026-57967)\n\n* wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller [eap-8.1.z] (CVE-2026-15555)\n\n* undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery [eap-8.1.z] (CVE-2026-15554)\n\n* jgroups: artemis cluster password leak via jgroups spoof [eap-8.1.z] (CVE-2026-49364)\n\n* artemis-server: artemis core protocol permits unauthed queue creation [eap-8.1.z] (CVE-2026-49362)\n\n* artemis-server: artemis messaging handlers in Red Hat EAP permit deserialization by default [eap-8.1.z] (CVE-2026-86404)\n\n* undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing [eap-8.1.z] (CVE-2026-5680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:70277",
        "url": "https://access.redhat.com/errata/RHSA-2026:70277"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/7137769",
        "url": "https://access.redhat.com/articles/7137769"
      },
      {
        "category": "external",
        "summary": "2455350",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455350"
      },
      {
        "category": "external",
        "summary": "2458638",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
      },
      {
        "category": "external",
        "summary": "2477930",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477930"
      },
      {
        "category": "external",
        "summary": "2477945",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477945"
      },
      {
        "category": "external",
        "summary": "2478013",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478013"
      },
      {
        "category": "external",
        "summary": "2480601",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480601"
      },
      {
        "category": "external",
        "summary": "2480637",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480637"
      },
      {
        "category": "external",
        "summary": "2480638",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480638"
      },
      {
        "category": "external",
        "summary": "2480729",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480729"
      },
      {
        "category": "external",
        "summary": "2483131",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483131"
      },
      {
        "category": "external",
        "summary": "2483133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483133"
      },
      {
        "category": "external",
        "summary": "2483135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483135"
      },
      {
        "category": "external",
        "summary": "2483136",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483136"
      },
      {
        "category": "external",
        "summary": "2483138",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483138"
      },
      {
        "category": "external",
        "summary": "2483140",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483140"
      },
      {
        "category": "external",
        "summary": "2484703",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484703"
      },
      {
        "category": "external",
        "summary": "2488304",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488304"
      },
      {
        "category": "external",
        "summary": "2488309",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488309"
      },
      {
        "category": "external",
        "summary": "2490628",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490628"
      },
      {
        "category": "external",
        "summary": "2491620",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491620"
      },
      {
        "category": "external",
        "summary": "2492010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
      },
      {
        "category": "external",
        "summary": "2492015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
      },
      {
        "category": "external",
        "summary": "2492016",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492016"
      },
      {
        "category": "external",
        "summary": "2492627",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492627"
      },
      {
        "category": "external",
        "summary": "2494771",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494771"
      },
      {
        "category": "external",
        "summary": "2500653",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500653"
      },
      {
        "category": "external",
        "summary": "2503101",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
      },
      {
        "category": "external",
        "summary": "2503103",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
      },
      {
        "category": "external",
        "summary": "2505422",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
      },
      {
        "category": "external",
        "summary": "2505911",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
      },
      {
        "category": "external",
        "summary": "2507482",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
      },
      {
        "category": "external",
        "summary": "2510195",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510195"
      },
      {
        "category": "external",
        "summary": "2510722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
      },
      {
        "category": "external",
        "summary": "2511026",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
      },
      {
        "category": "external",
        "summary": "2515377",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515377"
      },
      {
        "category": "external",
        "summary": "2521309",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
      },
      {
        "category": "external",
        "summary": "JBEAP-32314",
        "url": "https://issues.redhat.com/browse/JBEAP-32314"
      },
      {
        "category": "external",
        "summary": "JBEAP-32869",
        "url": "https://issues.redhat.com/browse/JBEAP-32869"
      },
      {
        "category": "external",
        "summary": "JBEAP-33162",
        "url": "https://issues.redhat.com/browse/JBEAP-33162"
      },
      {
        "category": "external",
        "summary": "JBEAP-33185",
        "url": "https://issues.redhat.com/browse/JBEAP-33185"
      },
      {
        "category": "external",
        "summary": "JBEAP-33236",
        "url": "https://issues.redhat.com/browse/JBEAP-33236"
      },
      {
        "category": "external",
        "summary": "JBEAP-33237",
        "url": "https://issues.redhat.com/browse/JBEAP-33237"
      },
      {
        "category": "external",
        "summary": "JBEAP-33288",
        "url": "https://issues.redhat.com/browse/JBEAP-33288"
      },
      {
        "category": "external",
        "summary": "JBEAP-33363",
        "url": "https://issues.redhat.com/browse/JBEAP-33363"
      },
      {
        "category": "external",
        "summary": "JBEAP-33405",
        "url": "https://issues.redhat.com/browse/JBEAP-33405"
      },
      {
        "category": "external",
        "summary": "JBEAP-33409",
        "url": "https://issues.redhat.com/browse/JBEAP-33409"
      },
      {
        "category": "external",
        "summary": "JBEAP-33413",
        "url": "https://issues.redhat.com/browse/JBEAP-33413"
      },
      {
        "category": "external",
        "summary": "JBEAP-33449",
        "url": "https://issues.redhat.com/browse/JBEAP-33449"
      },
      {
        "category": "external",
        "summary": "JBEAP-33459",
        "url": "https://issues.redhat.com/browse/JBEAP-33459"
      },
      {
        "category": "external",
        "summary": "JBEAP-33501",
        "url": "https://issues.redhat.com/browse/JBEAP-33501"
      },
      {
        "category": "external",
        "summary": "JBEAP-33616",
        "url": "https://issues.redhat.com/browse/JBEAP-33616"
      },
      {
        "category": "external",
        "summary": "JBEAP-33640",
        "url": "https://issues.redhat.com/browse/JBEAP-33640"
      },
      {
        "category": "external",
        "summary": "JBEAP-33683",
        "url": "https://issues.redhat.com/browse/JBEAP-33683"
      },
      {
        "category": "external",
        "summary": "JBEAP-33848",
        "url": "https://issues.redhat.com/browse/JBEAP-33848"
      },
      {
        "category": "external",
        "summary": "JBEAP-33871",
        "url": "https://issues.redhat.com/browse/JBEAP-33871"
      },
      {
        "category": "external",
        "summary": "JBEAP-33904",
        "url": "https://issues.redhat.com/browse/JBEAP-33904"
      },
      {
        "category": "external",
        "summary": "JBEAP-33925",
        "url": "https://issues.redhat.com/browse/JBEAP-33925"
      },
      {
        "category": "external",
        "summary": "JBEAP-33967",
        "url": "https://issues.redhat.com/browse/JBEAP-33967"
      },
      {
        "category": "external",
        "summary": "JBEAP-33968",
        "url": "https://issues.redhat.com/browse/JBEAP-33968"
      },
      {
        "category": "external",
        "summary": "JBEAP-33973",
        "url": "https://issues.redhat.com/browse/JBEAP-33973"
      },
      {
        "category": "external",
        "summary": "JBEAP-34018",
        "url": "https://issues.redhat.com/browse/JBEAP-34018"
      },
      {
        "category": "external",
        "summary": "JBEAP-34095",
        "url": "https://issues.redhat.com/browse/JBEAP-34095"
      },
      {
        "category": "external",
        "summary": "JBEAP-34096",
        "url": "https://issues.redhat.com/browse/JBEAP-34096"
      },
      {
        "category": "external",
        "summary": "JBEAP-34111",
        "url": "https://issues.redhat.com/browse/JBEAP-34111"
      },
      {
        "category": "external",
        "summary": "JBEAP-34161",
        "url": "https://issues.redhat.com/browse/JBEAP-34161"
      },
      {
        "category": "external",
        "summary": "JBEAP-34222",
        "url": "https://issues.redhat.com/browse/JBEAP-34222"
      },
      {
        "category": "external",
        "summary": "JBEAP-34521",
        "url": "https://issues.redhat.com/browse/JBEAP-34521"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70277.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update",
    "tracking": {
      "current_release_date": "2026-10-09T16:28:15+00:00",
      "generator": {
        "date": "2026-10-09T16:28:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:70277",
      "initial_release_date": "2026-09-22T15:35:34+00:00",
      "revision_history": [
        {
          "date": "2026-09-22T15:35:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-22T15:35:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-09T16:28:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 8.1",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 8.1",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 8.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3505",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-15T10:01:17.415497+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458638"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3505"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458638",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
        }
      ],
      "release_date": "2026-04-15T09:06:37.939000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Avishek Sarkar",
            "Brian Laub"
          ]
        }
      ],
      "cve": "CVE-2026-5680",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-06T10:28:57+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455350"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5680"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455350",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455350"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5680",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5680"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5680",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5680"
        }
      ],
      "release_date": "2026-07-04T23:59:59+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure the PerMessageDeflateHandshake to limit the maximum decompressed buffer size. This can be achieved by setting the maxDecompressedBufferSize parameter to a reasonable value (e.g., 10 MB) in the PerMessageDeflateHandshake constructor. This action may require a restart of the affected application or service to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing"
    },
    {
      "cve": "CVE-2026-10832",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-04T10:18:33.314000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484703"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate vulnerability in WildFly Elytron\u0027s ASN.1 DERDecoder can lead to a remote denial-of-service. An attacker can send a specially crafted DER payload with an inflated length, causing excessive memory allocation and exhausting JVM resources. This impacts Red Hat products that process untrusted DER/ASN.1 input, including SASL authentication mechanisms and X.500 certificate principal parsing paths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10832"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484703",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484703"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10832",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10832"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10832",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10832"
        }
      ],
      "release_date": "2026-09-18T14:13:32.848000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Gai Tanaka"
          ]
        }
      ],
      "cve": "CVE-2026-14180",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-04-28T14:55:07+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494771"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, \"smuggled\" request to be processed out of sync, potentially bypassing security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a frontend proxy to forward oversized, non-standard chunk-size values to the backend Undertow server. Successful exploitation allows an attacker to perform HTTP request smuggling, leading to request desynchronization. The vulnerability\u0027s root cause is an internal bitmask overlap in the ChunkReader state management logic where large chunk-size values collide with internal parser flags.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14180"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494771",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494771"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14180",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14180"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14180",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14180"
        }
      ],
      "release_date": "2026-08-11T11:14:47.691000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap"
    },
    {
      "cve": "CVE-2026-15554",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-05-21T19:34:31.218000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480601"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15554"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480601",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480601"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15554",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15554"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15554",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15554"
        }
      ],
      "release_date": "2026-08-11T05:49:31.658000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery"
    },
    {
      "cve": "CVE-2026-15555",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-05-21T20:47:36.888000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480637"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering \u2014 enabling RCE via deserialization gadget chains on every cluster node.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15555"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480637",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480637"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15555",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15555"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15555",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15555"
        }
      ],
      "release_date": "2026-08-11T05:49:54.473000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller"
    },
    {
      "cve": "CVE-2026-15560",
      "cwe": {
        "id": "CWE-829",
        "name": "Inclusion of Functionality from Untrusted Control Sphere"
      },
      "discovery_date": "2026-05-29T00:23:22.856000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483131"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "when EAP runs with -secmgr, the openjdk-orb\u0027s JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk-orb: unauthed class loading via IIOP in EAP",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15560"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483131",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483131"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15560",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15560"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15560",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15560"
        }
      ],
      "release_date": "2026-08-11T05:52:32.653000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openjdk-orb: unauthed class loading via IIOP in EAP"
    },
    {
      "cve": "CVE-2026-15561",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-29T00:41:31.600000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in EAP\u0027s undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15561"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15561"
        }
      ],
      "release_date": "2026-08-11T05:52:49.718000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow-core: OOM via missing limits in chunked trailer in EAP\u0027s Undertow"
    },
    {
      "cve": "CVE-2026-15562",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-05-29T00:52:03.986000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in EAP\u0027s jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in jboss-remoting affecting Red Hat JBoss Enterprise Application Platform. A remote, unauthenticated attacker can exploit an integer overflow in the MessageReader by completing a jboss-remoting handshake on exposed ports, leading to a severe degradation of server performance and potential resource exhaustion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15562"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15562",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15562"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15562",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15562"
        }
      ],
      "release_date": "2026-08-11T05:53:34.782000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service"
    },
    {
      "cve": "CVE-2026-15563",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2026-05-29T01:18:12.701000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483138"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in EAP\u0027s IIOP. The listener\u0027s NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15563"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483138",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483138"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15563",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15563"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15563"
        }
      ],
      "release_date": "2026-08-11T05:54:01.358000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wildfly-iiop-openjdk: Missing authentication on EAP\u0027s IIOP NameService leads to MITM or DoS"
    },
    {
      "cve": "CVE-2026-15565",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-19T00:58:08.395000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490628"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15565"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490628",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490628"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15565",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15565"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15565",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15565"
        },
        {
          "category": "external",
          "summary": "https://cwe.mitre.org/data/definitions/120.html",
          "url": "https://cwe.mitre.org/data/definitions/120.html"
        }
      ],
      "release_date": "2026-08-11T05:55:42.770000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Option 1 \u2014 Server-wide configuration to disable websockets handshake:\n  \u003c!-- Remove \u003cwebsockets/\u003e from standalone.xml servlet-container --\u003e\n  \u003cservlet-container name=\"default\"\u003e\n      \u003cjsp-config/\u003e\n      \u003c!-- \u003cwebsockets/\u003e  \u2190 remove this line entirely --\u003e\n  \u003c/servlet-container\u003e\n  isWebsocketsEnabled() returns false \u2192 no WebSocket upgrade accepted for any deployment.\n\nOption 2 \u2014 Per-application configuration to disable websockets handshake:\n  \u003c!-- WEB-INF/jboss-web.xml inside the WAR --\u003e\n  \u003cjboss-web\u003e\n      \u003cenable-websockets\u003efalse\u003c/enable-websockets\u003e\n  \u003c/jboss-web\u003e\n  Only that specific WAR\u0027s @ServerEndpoint classes are not registered.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method"
    },
    {
      "cve": "CVE-2026-15567",
      "discovery_date": "2026-06-23T03:03:11.963000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491620"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util\u0027s GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15567"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491620",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491620"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15567",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15567"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15567",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15567"
        }
      ],
      "release_date": "2026-08-11T05:55:33.625000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener"
    },
    {
      "cve": "CVE-2026-44417",
      "cwe": {
        "id": "CWE-15",
        "name": "External Control of System or Configuration Setting"
      },
      "discovery_date": "2026-05-22T13:00:55.251571+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480729"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache CXF. Untrusted users, if allowed to configure Java Message Service (JMS) for Apache CXF, can exploit this vulnerability to achieve remote code execution (RCE). This issue arises from an incomplete fix for a prior security flaw, indicating an alternative path that could lead to code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Apache CXF where an incomplete fix for a prior vulnerability allows remote code execution. Exploitation requires that untrusted users have permissions to configure Java Message Service (JMS) within the Apache CXF environment, which is not a default configuration in Red Hat products. Successful exploitation could lead to arbitrary code execution with the privileges of the affected service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44417"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480729",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480729"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44417",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44417"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44417",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44417"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o",
          "url": "https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o"
        }
      ],
      "release_date": "2026-05-22T12:17:25.102000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that only trusted users have permissions to configure Java Message Service (JMS) for Apache CXF. Restrict access to configuration files and management interfaces that control JMS settings. If JMS functionality is not required, consider disabling it to remove the attack vector.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration"
    },
    {
      "cve": "CVE-2026-46581",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-05-29T01:09:27.995000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483136"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46581"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483136",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483136"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46581"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46581",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46581"
        }
      ],
      "release_date": "2026-08-06T12:01:27.703000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include"
    },
    {
      "cve": "CVE-2026-49362",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2026-05-15T17:32:50.558000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477945"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49362"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477945",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477945"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49362",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49362"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49362",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49362"
        }
      ],
      "release_date": "2026-09-10T05:35:46.355000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation"
    },
    {
      "cve": "CVE-2026-49363",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2026-06-25T04:34:49.677000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492627"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore(), no credential verification, no subject validation. An unauthenticated attacker can send a single 5-byte packet on the CORE protocol (via :8080 HTTP-upgrade in EAP or :61616 in AMQ Broker) to obtain the broker\u0027s nodeID (type-1 UUID embedding MAC address), internal hostname/IP, port numbers, connector configurations, and backup/scale-down group names. In clustered deployments, a persistent ClusterTopologyListener is registered that continuously pushes all topology changes to the unauthenticated client. This contrasts with the federation handler in the same file which was fixed via ARTEMIS-5928 (CVE-2026-27446). The leaked nodeID UUID seed directly enables session-name brute-force for REATTACH_SESSION session hijack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49363"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492627",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492627"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49363",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49363"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49363",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49363"
        }
      ],
      "release_date": "2026-09-10T05:46:38.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "1. Remove Core protocol from internet-facing acceptors -- configure the protocols parameter to exclude Core protocol on any acceptor receiving untrusted connections. In EAP, the :8080 HTTP-upgrade acceptor supports Core by default; restricting to AMQP/STOMP/OpenWire prevents the attack entirely.\n\n2. Enable mutual TLS -- configure sslEnabled=true with needClientAuth=true on all Core protocol acceptors. TLS handshake failure occurs before any protocol-level packet can be sent.\n\n3. Disable HTTP-upgrade for Core protocol if not required -- remove the http-upgrade element from the Artemis acceptor configuration to eliminate the :8080 attack surface.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0"
    },
    {
      "cve": "CVE-2026-49364",
      "discovery_date": "2026-05-15T19:27:48.489000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2478013"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49364"
        },
        {
          "category": "external",
          "summary": "RHBZ#2478013",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478013"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49364",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49364"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49364",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49364"
        }
      ],
      "release_date": "2026-09-10T05:38:15.414000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof"
    },
    {
      "cve": "CVE-2026-49875",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2026-06-12T10:01:23.698724+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488309"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band (OOB) external entity resolution, a type of XML External Entity (XXE) vulnerability. A remote attacker could exploit this to disclose sensitive information from the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important information disclosure vulnerability in Apache CXF, affecting Red Hat products that bundle the component, such as Enterprise Application Platform, JBoss Web Server, and Red Hat Single Sign-On. The flaw allows a remote attacker to disclose sensitive information due to improper XML parsing configurations, which can be exploited without user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49875"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488309",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488309"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49875",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49875"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49875",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49875"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/06/11/2",
          "url": "http://www.openwall.com/lists/oss-security/2026/06/11/2"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o",
          "url": "https://lists.apache.org/thread/3kb9w5bg90xcp06fccoz9k3gpsvyy79o"
        }
      ],
      "release_date": "2026-06-12T08:54:50.103000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening"
    },
    {
      "cve": "CVE-2026-50632",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-06-12T10:01:09.993388+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488304"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache CXF. This vulnerability, stemming from an incomplete fix for a previous issue, allows untrusted users who can configure Java Message Service (JMS) for Apache CXF to achieve arbitrary code execution. This could lead to a complete compromise of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cxf: org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Apache CXF\u0027s JMS transport allows arbitrary code execution. The vulnerability occurs when untrusted users can configure Java Message Service (JMS) for Apache CXF, potentially leading to a complete system compromise. This risk is present in environments where JMS configuration is accessible to or managed by untrusted entities.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50632"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488304",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488304"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50632",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50632"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50632",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50632"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw",
          "url": "https://lists.apache.org/thread/740ghch5z5y675cn2kzgtyo5k37n6qcw"
        }
      ],
      "release_date": "2026-06-12T09:00:48.530000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that only trusted administrators have the necessary permissions to configure Java Message Service (JMS) for Apache CXF. Restricting access to JMS configuration prevents untrusted users from exploiting this vulnerability. Review and enforce strict access controls on systems where Apache CXF is deployed with JMS transport.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cxf: org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration"
    },
    {
      "cve": "CVE-2026-54512",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-06-23T22:01:49.821346+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5988"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
        }
      ],
      "release_date": "2026-06-23T20:56:36.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
    },
    {
      "cve": "CVE-2026-54513",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "discovery_date": "2026-06-23T22:01:34.437620+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54513",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5",
          "url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e",
          "url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5981",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5981"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5983",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5983"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/pull/5984",
          "url": "https://github.com/FasterXML/jackson-databind/pull/5984"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f"
        }
      ],
      "release_date": "2026-06-23T20:53:52.543000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application\u2019s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change.\n\nAs an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution"
    },
    {
      "cve": "CVE-2026-54515",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-06-23T22:01:52.824092+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492016"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly ignored properties. This could lead to unintended changes in application data, impacting data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate impact flaw in jackson-databind where applications enabling case-insensitive property matching alongside per-property @JsonIgnoreProperties may inadvertently expose fields to unauthorized modification. This bypass of intended property exclusions could lead to data integrity issues within affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54515"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492016",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492016"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54515",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54515"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa",
          "url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5962",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5962"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/5964",
          "url": "https://github.com/FasterXML/jackson-databind/issues/5964"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"
        }
      ],
      "release_date": "2026-06-23T20:50:25.715000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified"
    },
    {
      "cve": "CVE-2026-55831",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-21T00:02:57.305291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503103"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in Netty\u0027s SPDY SETTINGS decoder, allowing a remote unauthenticated attacker to exhaust system resources. By sending a specially crafted SPDY/3.1 SETTINGS frame, an attacker can cause excessive memory allocation and CPU usage, leading to a denial of service. This vulnerability has a low attack complexity and requires no user interaction or privileges.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503103",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55831",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
        }
      ],
      "release_date": "2026-07-20T23:00:31.859000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing"
    },
    {
      "cve": "CVE-2026-55833",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-21T00:01:25.203265+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503101"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY header decoding. A remote, unauthenticated attacker can send a small, compressed SPDY header block that, during decompression, expands significantly beyond configured limits. This leads to excessive CPU and memory consumption, potentially causing resource exhaustion and service unavailability in affected Red Hat products that utilize Netty with SPDY.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503101",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55833",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
        }
      ],
      "release_date": "2026-07-20T23:18:07.893000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification"
    },
    {
      "cve": "CVE-2026-56745",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-07-21T22:52:47.296001+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505911"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty\u0027s SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY-to-HTTP codec, affecting Red Hat products that utilize vulnerable versions of Netty. A remote, unauthenticated attacker can exploit a memory leak in the `SpdyHttpDecoder` by sending specially crafted `SYN_STREAM` frames, leading to native memory exhaustion and a denial of service for the affected system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505911",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56745",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
        }
      ],
      "release_date": "2026-07-21T21:31:25.307000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec"
    },
    {
      "cve": "CVE-2026-56746",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-21T22:30:30.983812+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505422"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat ships Netty\u0027s netty-codec-http component in multiple products. The CorsHandler shortCircuit() feature, when enabled, is intended to reject unauthorized cross-origin requests before they reach the application. Due to a logical operator error in origin validation, requests with a null Origin header bypass this protection entirely. Upgrade to Netty 4.1.136.Final or 4.2.16.Final to resolve this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505422",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56746",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"
        }
      ],
      "release_date": "2026-07-21T21:36:18.627000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "If CORS short-circuit functionality is not required, disable the shortCircuit() configuration in the CorsHandler. Alternatively, implement application-level origin validation to reject requests with null Origin headers. A web application firewall (WAF) can also be configured to block requests with null or missing Origin headers.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header"
    },
    {
      "cve": "CVE-2026-57967",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2026-05-21T21:25:08.084000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480638"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "in Apache Artemis, the REATTACH_SESSION handler performs zero authentication \u2014 it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker\u0027s connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "artemis-server: Apache Artemis \u2014 session hijack via missing authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57967"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480638",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480638"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57967",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57967"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57967",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57967"
        }
      ],
      "release_date": "2026-09-10T05:40:15.760000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "artemis-server: Apache Artemis \u2014 session hijack via missing authentication"
    },
    {
      "cve": "CVE-2026-59649",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T02:01:15.252829+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Bouncy Castle for Java. The software\u0027s processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine (JVM) maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message, leading to excessive memory consumption and a Denial of Service (DoS) condition where the application becomes unresponsive or crashes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The OpenPGP user-attribute subpacket length is bounded only by the JVM maximum memory, so processing a specially crafted OpenPGP message causes excessive memory consumption and a denial of service. This is reachable only via the OpenPGP (bcpg) code paths; products that do not parse untrusted OpenPGP messages are not exposed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59649"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59649",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59649"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59649",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59649"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/commit/a43c40dc12c3e1c6cbd03c83fe30aaec4029b824",
          "url": "https://github.com/bcgit/bc-java/commit/a43c40dc12c3e1c6cbd03c83fe30aaec4029b824"
        },
        {
          "category": "external",
          "summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59649",
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59649"
        }
      ],
      "release_date": "2026-08-03T00:44:24.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpg-fips 1.0.13/2.0.13/2.1.13) once available for the affected product.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length"
    },
    {
      "cve": "CVE-2026-59889",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-07-14T21:02:42.035358+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500653"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-databind. The UnwrappedPropertyHandler.processUnwrapped() method, responsible for handling @JsonUnwrapped properties, replays buffered JSON without properly checking the active view. This allows an attacker to write data to a property annotated with both @JsonView and @JsonUnwrapped even when deserializing under a less-privileged view. This can lead to mass-assignment and privilege escalation, enabling an untrusted caller to modify sensitive data that should be restricted to privileged users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59889"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500653",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500653"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59889",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59889"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b",
          "url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/issues/6060",
          "url": "https://github.com/FasterXML/jackson-databind/issues/6060"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/pull/6056",
          "url": "https://github.com/FasterXML/jackson-databind/pull/6056"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh",
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"
        }
      ],
      "release_date": "2026-07-14T19:57:48.473000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties"
    },
    {
      "cve": "CVE-2026-59899",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507482"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Netty\u0027s HTTP decoder, which could lead to a denial of service. Red Hat products utilizing `netty-codec-http` are susceptible to memory exhaustion when processing specially crafted, highly compressed HTTP payloads. This allows a remote attacker to trigger excessive memory allocation, impacting system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507482",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
        },
        {
          "category": "external",
          "summary": "https://netty.io/news/2026/07/09/4-1-136-Final.html",
          "url": "https://netty.io/news/2026/07/09/4-1-136-Final.html"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)"
    },
    {
      "cve": "CVE-2026-62243",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-08-22T12:51:41.376413+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2521309"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products. While the CVSS score reflects the severity of a successful exploit \u2014 full confidentiality compromise of TLS-protected traffic without authentication \u2014 the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime. Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-62243"
        },
        {
          "category": "external",
          "summary": "RHBZ#2521309",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-62243",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-62243"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass",
          "url": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass"
        }
      ],
      "release_date": "2026-08-22T12:26:43.072000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). \n\nThe following mitigations can reduce exposure without applying a patch:\n\n1) Use the default JDK SSL provider \u2014 Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden.\n\n2) Use X509ExtendedTrustManager \u2014 If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic.\n\n3) Run on Java 24 or earlier \u2014 The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration"
    },
    {
      "cve": "CVE-2026-68494",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-04T15:01:53.631865+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511026"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511026",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
          "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
          "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
          "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/pull/1611",
          "url": "https://github.com/FasterXML/jackson-core/pull/1611"
        },
        {
          "category": "external",
          "summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
          "url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
        }
      ],
      "release_date": "2026-08-04T14:39:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Upgrade com.fasterxml.jackson.core:jackson-core to a fixed version, such as 2.18.8 or later, 2.21.4 or later, or the first fixed release in the applicable 2.22.x stream. For Jackson 3.x, upgrade to 3.1.4 or later, or the first fixed release in the applicable 3.2.x stream. If upgrading is not immediately possible, do not expose the non-blocking parser to untrusted, incrementally streamed JSON. Where feasible, use a synchronous parser or buffer and enforce strict request-size, connection-timeout, and concurrency limits at the ingress layer. Apply the upgrade as soon as possible because ingress limits reduce exposure but do not correct the parser defect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
    },
    {
      "cve": "CVE-2026-69152",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T18:01:13.566423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that pass user-controlled input to the `expand()` function are vulnerable to this issue. This flaw can result in an excessive consumption of memory that eventually terminates the process or blocks the event loop, both causing a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        }
      ],
      "release_date": "2026-08-03T16:33:36.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not pass untrusted input to the expand() function.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "cve": "CVE-2026-73508",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-08-13T15:11:47.778030+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515377"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated Important because the affected component fails to release allocated memory when it rejects a malformed domain name during DNS record decoding. An unauthenticated remote attacker who can send DNS traffic to an application using the affected DNS resolution functionality can incrementally exhaust available memory until the process becomes unresponsive, resulting in a complete denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73508"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515377",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515377"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73508",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73508"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73508",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73508"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3"
        }
      ],
      "release_date": "2026-08-13T14:27:20.298000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Red Hat recommends upgrading to a fixed version as the primary remediation. Where an immediate upgrade is not possible, restrict network access so that only trusted DNS servers and trusted network peers can send DNS traffic to the affected application, using firewall or network policy rules to block or rate-limit DNS traffic from untrusted sources. This reduces exposure to the malformed DNS records that trigger the issue but does not fully eliminate it; upgrading remains the only complete fix.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names"
    },
    {
      "cve": "CVE-2026-85511",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2026-05-29T01:29:31.761000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483140"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in EAP\u0027s Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron-realm-token: parameter injection in EAP\u0027s elytron oauth2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this issue as having a Low impact.\n\nThis flaw is limited to improper parameter formatting when the application server forwards a token to an external Identity Provider (IdP) for verification. Under specific conditions, a malformed token can inject additional data into that outgoing verification request.\n\nThe application server relies on the external IdP to decide whether a token is valid, and standard IdPs automatically reject malformed or invalid requests. Additionally, role and access permissions are strictly enforced inside the application server after the identity check is completed.\n\nBecause an attacker cannot force an authentication bypass using a standard IdP setup, the overall security risk is minimal and the real-world impact remains low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-85511"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483140",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483140"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-85511",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-85511"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85511",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85511"
        }
      ],
      "release_date": "2026-09-18T14:17:59.097000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "wildfly-elytron-realm-token: parameter injection in EAP\u0027s elytron oauth2"
    },
    {
      "cve": "CVE-2026-86404",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2026-05-15T15:34:21.130000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477930"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "EAP\u0027s Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86404"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477930",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477930"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86404",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86404"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86404",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86404"
        }
      ],
      "release_date": "2026-08-11T05:45:33.075000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T15:35:34+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:70277"
        },
        {
          "category": "workaround",
          "details": "Configure a restrictive deserialization-allow-list on every pooled-connection-factory resource. For example, if your MDBs only expect to receive objects of type com.yourapp.OrderEvent, set the allow-list to \"com.yourapp\". This switches ObjectInputStreamWithClassLoader from \"allow everything\" to \"deny by default, allow only listed classes.\" With this in place, even if an attacker injects a malicious ObjectMessage through any vector, the deserialization of gadget chain classes is blocked.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.