JBoss Core Services for RHEL 8 vulnerabilities

6 known vulnerabilities in JBoss Core Services for RHEL 8 from Red Hat. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache HTTP Server: Memory Allocation with Excessive Size Value

  CVE-2026-49975Jun 8, 2026ApacheEPSS 33%

  Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

• 7.3 High severity

  Apache HTTP Server: Buffer Over-read

  CVE-2026-44185Jun 8, 2026Apache

  Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

• 7.5 High severity

  Apache HTTP Server: Heap-based Buffer Overflow

  CVE-2026-42536Jun 8, 2026ApacheEPSS 1.02%

  Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

• 7.5 High severity

  Apache HTTP Server: Heap-based Buffer Overflow

  CVE-2026-34355Jun 8, 2026ApacheEPSS 1.16%

  A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

• 8.1 High severity

  Apache HTTP Server: Heap-based Buffer Overflow

  CVE-2026-28780May 5, 2026ApacheEPSS 1.38%

  Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after

• 7.5 High severity

  nghttp2: Reachable Assertion

  CVE-2026-27135Mar 18, 2026Nghttp2

  nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2`