Red Hat JBoss Enterprise Application Platform 7 vulnerabilities
93 known vulnerabilities in Red Hat JBoss Enterprise Application Platform 7 from Red Hat. 93 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
image-size: Loop with Unreachable Exit Condition
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can tri
- 7.5 High severity
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not…
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are rec
- 7.5 High severity
netty: Uncontrolled Resource Consumption
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariabl
- 9.1 Critical severity
Spring Boot: Missing Authorization
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and re
- 7.5 High severity
Spring Boot: Use of Insufficiently Random Values
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fi
- 9.4 Critical severity
Apache Camel: Deserialization of Untrusted Data
The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure the 'in' direc
- 7.2 High severity
Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker nam
- 8.8 High severity
Improper Input Validation, Improper Control of Generation of Code ('Code Injection')…
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HT
- 7.3 High severity
Apache HttpClient: Missing Critical Step in Authentication
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes thi
- 7.5 High severity
Spring Security: Improper Access Control
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorizatio
- 8.1 High severity
Spring Security: Improper Validation of Certificate with Host Mismatch
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an
- 8.6 High severity
Apache Kafka: Improper Validation of Specified Index, Position, or Offset in Input
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validat
- 9.0 Critical severity
thymeleaf: Improper Neutralization of Special Elements used in an Expression Language Statement
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expres
- 9.0 Critical severity
thymeleaf: Improper Neutralization of Special Elements used in an Expression Language Statement
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression
- 7.5 High severity
BC-JAVA: Covert Timing Channel
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from
- 9.1 Critical severity
Eclipse Jetty: Inconsistent Interpretation of HTTP Requests
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html
- 7.5 High severity
Apache ActiveMQ Client: Uncontrolled Resource Consumption
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to
- 8.8 High severity
Apache ActiveMQ Improper Input Validation Exploited
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia
- 7.5 High severity
netty: Allocation of Resources Without Limits or Throttling
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server
- 7.5 High severity
netty: Inconsistent Interpretation of HTTP Requests
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versi
- 9.1 Critical severity
Red Hat JBoss Enterprise Application Platform…: Inconsistent Interpretation of HTTP Requests
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploi
- 9.1 Critical severity
Red Hat JBoss Enterprise Application Platform…: Inconsistent Interpretation of HTTP Requests
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to
- 9.1 Critical severity
Red Hat JBoss Enterprise Application Platform…: Inconsistent Interpretation of HTTP Requests
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud
- 7.5 High severity
path-to-regexp: Uncontrolled Resource Consumption
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in ver
- 8.8 High severity
Red Hat build of Apache Camel 4.18.1 for…: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
- 9.8 Critical severity
flatted: Improperly Controlled Modification of Object Prototype Attributes
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a
- 7.5 High severity
flatted: Uncontrolled Recursion
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion dept
- 7.5 High severity
Apache ZooKeeper: Insertion of Sensitive Information into Log File
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level
- 7.4 High severity
Apache ZooKeeper: Improper Certificate Validation
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It
- 7.5 High severity
Eclipse Jetty: Missing Release of Memory after Effective Lifetime
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Infl
- 8.0 High severity
c3p0: Improper Control of Generation of Code
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` whic
- 9.8 Critical severity
mchange-commons-java: Improper Neutralization of Special Elements in Output Used by a Downstream Component
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running appli
- 7.5 High severity
A flaw was found in Undertow. Servlets using a method that calls…
A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a
- 8.2 High severity
node-tar: Improper Limitation of a Pathname to a Restricted Directory
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a maliciou
- 8.3 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Neutralization of Special Elements used in an SQL Command
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. Th
- 7.0 High severity
cli: Incorrect Permission Assignment for Critical Resource
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on
- 9.6 Critical severity
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and…
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicio
- 7.5 High severity
A flaw was found in Undertow that can cause remote denial of service attacks.
A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause
- 7.5 High severity
Red Hat build of Apache Camel 4.14.2 for…: Allocation of Resources Without Limits or Throttling
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeated
- 7.5 High severity
Red Hat build of Apache Camel 4.8.5 for Spring…: Improperly Controlled Sequential Memory Allocation
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of ser