Red Hat JBoss Core Services vulnerabilities

7 known vulnerabilities in Red Hat JBoss Core Services from Red Hat. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  OpenSSL: Use After Free

  CVE-2026-45447Jun 9, 2026OpenSSLEPSS 4%

  Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When

• 7.5 High severity

  Apache HTTP Server: Memory Allocation with Excessive Size Value

  CVE-2026-49975Jun 8, 2026ApacheEPSS 33%

  Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

• 8.8 High severity

  Apache HTTP Server: Double Free

  CVE-2026-23918May 4, 2026ApacheEPSS 49.7%

  Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

• 7.5 High severity

  Red Hat Hardened Images: Access of Resource Using Incompatible Type

  CVE-2026-6732Apr 23, 2026Red Hat

  A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, l

• 7.3 High severity

  Apache HttpClient: Missing Critical Step in Authentication

  CVE-2026-40542Apr 22, 2026Apache

  Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes thi

• 8.8 High severity

  Red Hat build of Apache Camel 4.18.1 for…: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-67030Mar 25, 2026Red Hat

  Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

• 7.8 High severity

  zlib: Out-of-bounds Write

  CVE-2026-22184Jan 7, 2026Zlib Software

  zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw oc