Red Hat JBoss Enterprise Application Platform 7 vulnerabilities
93 known vulnerabilities in Red Hat JBoss Enterprise Application Platform 7 from Red Hat. 93 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Red Hat JBoss Enterprise Application Platform…: Privilege Defined With Unsafe Actions
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files.
- 8.0 High severity
Red Hat build of Keycloak 26.4: Improper Certificate Validation
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificat
- 7.4 High severity
Red Hat build of Keycloak 26.4: Improper Verification of Cryptographic Signature
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the ap
- 7.4 High severity
Red Hat JBoss Enterprise Application Platform…: Inclusion of Functionality from Untrusted Control Sphere
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows u
- 7.4 High severity
Red Hat JBoss Enterprise Application Platform…: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a
- 7.1 High severity
Red Hat Enterprise Linux 8: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can wr
- 8.8 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a mi
- 7.5 High severity
Red Hat build of Apache Camel for Spring Boot 4: Improper Neutralization of CRLF Sequences
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF
- 8.2 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Inconsistent Interpretation of HTTP Requests
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prior
- 7.5 High severity
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending…
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests
- 7.5 High severity
A flaw was found in Netty's HTTP/2 codec.
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by sup
- 7.5 High severity
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips…
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP req
- 7.5 High severity
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder…
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS)
- 7.5 High severity
A flaw was found in Netty's WebSocketServerExtensionHandler.
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-con
- 7.5 High severity
A flaw was found in the Netty STOMP codec.
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Den
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Allocation of Resources Without Limits or Throttling
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leadi
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Allocation of Resources Without Limits or Throttling
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection
- 7.5 High severity
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this…
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowi
- 7.5 High severity
Red Hat build of Apache Camel for Spring Boot 4: Allocation of Resources Without Limits or Throttling
A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of he
- 7.5 High severity
A flaw was found in Netty's `SmtpResponseDecoder` component.
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vuln
- 7.5 High severity
A flaw was found in Netty's StompSubframeDecoder component.
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) t
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.4.redhat: Improper Handling of Highly Compressed Data (Data Amplification)
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enorm
- 7.4 High severity
Red Hat Build of Apache Camel 3.33.4.redhat: Origin Validation Error
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-orig
- 8.8 High severity
Red Hat JBoss Enterprise Application Platform…: Deserialization of Untrusted Data
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by defaul
- 7.5 High severity
Red Hat build of Apache Camel for Spring Boot 4: Allocation of Resources Without Limits or Throttling
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default
- 7.5 High severity
Red Hat JBoss Enterprise Application Platform…: Allocation of Resources Without Limits or Throttling
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuff
- 7.4 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Improper Handling of Alternate Encoding
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary
- 7.5 High severity
Red Hat JBoss Enterprise Application Platform…: Memory Allocation with Excessive Size Value
A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.
- 7.5 High severity
Red Hat JBoss Enterprise Application Platform…: Buffer Copy without Checking Size of Input
A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication
- 7.4 High severity
Red Hat JBoss Enterprise Application Platform…: Missing Authentication for Critical Functionality
A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.
- 7.5 High severity
Red Hat JBoss Enterprise Application Platform…: Integer Overflow or Wraparound
A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.
- 7.5 High severity
Red Hat JBoss Enterprise Application Platform…: Allocation of Resources Without Limits or Throttling
A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achievin
- 8.1 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Verification of Cryptographic Signature
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
- 8.8 High severity
Red Hat JBoss Enterprise Application Platform…: Deserialization of Untrusted Data
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
- 7.4 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Certificate Validation
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a for
- 9.8 Critical severity
Red Hat JBoss Enterprise Application Platform…: Improper Verification of Cryptographic Signature
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disc
- 8.1 High severity
jackson-databind: Incomplete List of Disallowed Inputs
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only
- 8.8 High severity
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration…
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users
- 9.8 Critical severity
Apache CXF: Improper Restriction of XML External Entity Reference
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or
- 7.5 High severity
js-cookie: Improperly Controlled Modification of Object Prototype Attributes
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__pro